rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 58 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions

chore(deps): update dependency pypdf to v6.21.2 [security] #1232

Merged
renovate-bot merged 1 commit from renovate/pypi-pypdf-vulnerability into main 2026-10-24 00:49:06 +00:00
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-10-22 00:19:24 +00:00
Contributor
Copy link

This PR contains the following updates:

Package Change Age Confidence
pypdf (changelog) ==6.19.0 → ==6.21.2 age confidence

pypdf: Possible infinite loop when hitting EOF in standard xref table

CVE-2026-113794 / GHSA-39mj-jf6j-2qj3

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.

Patches

This has been fixed in pypdf==6.20.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4170.

Notes

This has been reported through both the secure channel and as a public issue at #​4169.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for streams with multiple filters

CVE-2026-113795 / GHSA-7mh2-4gg2-979f

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.

Patches

This has been fixed in pypdf==6.20.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4173.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when removing tree items

CVE-2026-113793 / GHSA-9mx8-4j7g-633p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.

Patches

This has been fixed in pypdf==6.20.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4188.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop in PdfWriter.find_outline_item

CVE-2026-113792 / GHSA-qfv9-64jg-mh7p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling find_outline_item on a PdfWriter.

Patches

This has been fixed in pypdf==6.20.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4188.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage when retrieving form fields

CVE-2026-113789 / GHSA-6vvc-x485-93v7

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.

Patches

This has been fixed in pypdf==6.21.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4219.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage when parsing content streams

CVE-2026-113791 / GHSA-cgf9-327m-v77c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.

Patches

This has been fixed in pypdf==6.21.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4218.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage when parsing arrays and dictionaries

CVE-2026-113790 / GHSA-f54x-cmq8-qg57

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.

Patches

This has been fixed in pypdf==6.21.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4218.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Unvalidated JPEG image data loading

CVE-2026-113786 / GHSA-5hx5-vpf9-5wcv

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data).

Users which do not have the optional Pillow dependency installed in their environment are not affected.

Patches

This has been fixed in pypdf==6.21.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4222.

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for repeated references to the same missing object

CVE-2026-115572 / GHSA-6c7f-9265-g8fw

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4240.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for large xref table header limits

CVE-2026-115580 / GHSA-gmh7-3g9r-mjh5

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4239.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

CVE-2026-115585 / GHSA-jr96-gvgh-j3r4

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​4240.

Notes

This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

py-pdf/pypdf (pypdf)

v6.21.2

Compare Source

Security (SEC)
  • Avoid repeated full file loads (#​4240)
  • Limit size of standard xref table (#​4239)
Bug Fixes (BUG)
  • Decode UniGB-UTF16 CMaps as UTF-16BE (#​4231)
  • Keep 8-bit DeviceRGB image mode (#​4230)
  • Preserve all annotation quadrilaterals when merging pages (#​4223)
Robustness (ROB)
  • Multiple fixes

Full Changelog

v6.21.1

Compare Source

Security (SEC)
  • Avoid repeated full file loads (#​4240)
  • Limit size of standard xref table (#​4239)
Bug Fixes (BUG)
  • Decode UniGB-UTF16 CMaps as UTF-16BE (#​4231)
  • Keep 8-bit DeviceRGB image mode (#​4230)
  • Preserve all annotation quadrilaterals when merging pages (#​4223)
Robustness (ROB)
  • Multiple fixes

Full Changelog

v6.21.0

Compare Source

Security (SEC)
  • Only open /DCTDecode image data with the Pillow JPEG plugin (#​4222)

Full Changelog

v6.20.1

Compare Source

Security (SEC)
  • Improve performance and limit field work (#​4219)
  • Limit stream parsing work (#​4218)
New Features (ENH)
  • Allow custom fit modes for named destinations (#​4181)
Bug Fixes (BUG)
  • Treat NUL as whitespace in ArrayObject (#​4198)
  • Avoid overwriting unread objects in add_form_topname (#​4190)
  • Read an indirect page box on a writer page (#​4179)

Full Changelog

v6.20.0

Compare Source

Security (SEC)
  • Prevent cyclic tree handling (#​4188)
Bug Fixes (BUG)
  • Only read the color operator from a text field's default appearance (#​4158)

Full Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pypdf](https://github.com/py-pdf/pypdf) ([changelog](https://pypdf.readthedocs.io/en/latest/meta/CHANGELOG.html)) | `==6.19.0` → `==6.21.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pypdf/6.21.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pypdf/6.19.0/6.21.2?slim=true) | --- ### pypdf: Possible infinite loop when hitting EOF in standard xref table [CVE-2026-113794](https://nvd.nist.gov/vuln/detail/CVE-2026-113794) / [GHSA-39mj-jf6j-2qj3](https://github.com/advisories/GHSA-39mj-jf6j-2qj3) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. ##### Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4170](https://github.com/py-pdf/pypdf/pull/4170). ##### Notes This has been reported through both the secure channel and as a public issue at [#&#8203;4169](https://github.com/py-pdf/pypdf/issues/4169). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3](https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3) - [https://github.com/py-pdf/pypdf/issues/4169](https://github.com/py-pdf/pypdf/issues/4169) - [https://github.com/py-pdf/pypdf/pull/4170](https://github.com/py-pdf/pypdf/pull/4170) - [https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58](https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-39mj-jf6j-2qj3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for streams with multiple filters [CVE-2026-113795](https://nvd.nist.gov/vuln/detail/CVE-2026-113795) / [GHSA-7mh2-4gg2-979f](https://github.com/advisories/GHSA-7mh2-4gg2-979f) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. ##### Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4173](https://github.com/py-pdf/pypdf/pull/4173). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f](https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f) - [https://github.com/py-pdf/pypdf/pull/4173](https://github.com/py-pdf/pypdf/pull/4173) - [https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185](https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-7mh2-4gg2-979f) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop when removing tree items [CVE-2026-113793](https://nvd.nist.gov/vuln/detail/CVE-2026-113793) / [GHSA-9mx8-4j7g-633p](https://github.com/advisories/GHSA-9mx8-4j7g-633p) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. ##### Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4188](https://github.com/py-pdf/pypdf/pull/4188). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mx8-4j7g-633p](https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mx8-4j7g-633p) - [https://github.com/py-pdf/pypdf/pull/4188](https://github.com/py-pdf/pypdf/pull/4188) - [https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0](https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9mx8-4j7g-633p) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop in PdfWriter.find_outline_item [CVE-2026-113792](https://nvd.nist.gov/vuln/detail/CVE-2026-113792) / [GHSA-qfv9-64jg-mh7p](https://github.com/advisories/GHSA-qfv9-64jg-mh7p) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`. ##### Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4188](https://github.com/py-pdf/pypdf/pull/4188). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-qfv9-64jg-mh7p](https://github.com/py-pdf/pypdf/security/advisories/GHSA-qfv9-64jg-mh7p) - [https://github.com/py-pdf/pypdf/pull/4188](https://github.com/py-pdf/pypdf/pull/4188) - [https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0](https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-qfv9-64jg-mh7p) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes/large memory usage when retrieving form fields [CVE-2026-113789](https://nvd.nist.gov/vuln/detail/CVE-2026-113789) / [GHSA-6vvc-x485-93v7](https://github.com/advisories/GHSA-6vvc-x485-93v7) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. ##### Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4219](https://github.com/py-pdf/pypdf/pull/4219). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7](https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7) - [https://nvd.nist.gov/vuln/detail/CVE-2026-113789](https://nvd.nist.gov/vuln/detail/CVE-2026-113789) - [https://github.com/py-pdf/pypdf/pull/4219](https://github.com/py-pdf/pypdf/pull/4219) - [https://github.com/py-pdf/pypdf/commit/5ef728f0e16d225c853e89f861ba0a67402fe3f2](https://github.com/py-pdf/pypdf/commit/5ef728f0e16d225c853e89f861ba0a67402fe3f2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6vvc-x485-93v7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage when parsing content streams [CVE-2026-113791](https://nvd.nist.gov/vuln/detail/CVE-2026-113791) / [GHSA-cgf9-327m-v77c](https://github.com/advisories/GHSA-cgf9-327m-v77c) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. ##### Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4218](https://github.com/py-pdf/pypdf/pull/4218). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-cgf9-327m-v77c](https://github.com/py-pdf/pypdf/security/advisories/GHSA-cgf9-327m-v77c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-113791](https://nvd.nist.gov/vuln/detail/CVE-2026-113791) - [https://github.com/py-pdf/pypdf/pull/4218](https://github.com/py-pdf/pypdf/pull/4218) - [https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12](https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-cgf9-327m-v77c) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage when parsing arrays and dictionaries [CVE-2026-113790](https://nvd.nist.gov/vuln/detail/CVE-2026-113790) / [GHSA-f54x-cmq8-qg57](https://github.com/advisories/GHSA-f54x-cmq8-qg57) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. ##### Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4218](https://github.com/py-pdf/pypdf/pull/4218). #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57](https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57) - [https://nvd.nist.gov/vuln/detail/CVE-2026-113790](https://nvd.nist.gov/vuln/detail/CVE-2026-113790) - [https://github.com/py-pdf/pypdf/pull/4218](https://github.com/py-pdf/pypdf/pull/4218) - [https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12](https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f54x-cmq8-qg57) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Unvalidated JPEG image data loading [CVE-2026-113786](https://nvd.nist.gov/vuln/detail/CVE-2026-113786) / [GHSA-5hx5-vpf9-5wcv](https://github.com/advisories/GHSA-5hx5-vpf9-5wcv) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data). Users which do not have the optional *Pillow* dependency installed in their environment are not affected. ##### Patches This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4222](https://github.com/py-pdf/pypdf/pull/4222). #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-113786](https://nvd.nist.gov/vuln/detail/CVE-2026-113786) - [https://github.com/py-pdf/pypdf/pull/4222](https://github.com/py-pdf/pypdf/pull/4222) - [https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07](https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5hx5-vpf9-5wcv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for repeated references to the same missing object [CVE-2026-115572](https://nvd.nist.gov/vuln/detail/CVE-2026-115572) / [GHSA-6c7f-9265-g8fw](https://github.com/advisories/GHSA-6c7f-9265-g8fw) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. ##### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4240](https://github.com/py-pdf/pypdf/pull/4240). #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw](https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw) - [https://github.com/py-pdf/pypdf/pull/4240](https://github.com/py-pdf/pypdf/pull/4240) - [https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b](https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6c7f-9265-g8fw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for large xref table header limits [CVE-2026-115580](https://nvd.nist.gov/vuln/detail/CVE-2026-115580) / [GHSA-gmh7-3g9r-mjh5](https://github.com/advisories/GHSA-gmh7-3g9r-mjh5) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. ##### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4239](https://github.com/py-pdf/pypdf/pull/4239). #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5](https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5) - [https://github.com/py-pdf/pypdf/pull/4239](https://github.com/py-pdf/pypdf/pull/4239) - [https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2](https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gmh7-3g9r-mjh5) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) [CVE-2026-115585](https://nvd.nist.gov/vuln/detail/CVE-2026-115585) / [GHSA-jr96-gvgh-j3r4](https://github.com/advisories/GHSA-jr96-gvgh-j3r4) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. ##### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;4240](https://github.com/py-pdf/pypdf/pull/4240). ##### Notes This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present. #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4) - [https://github.com/py-pdf/pypdf/pull/4240](https://github.com/py-pdf/pypdf/pull/4240) - [https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b](https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jr96-gvgh-j3r4) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>py-pdf/pypdf (pypdf)</summary> ### [`v6.21.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6212-2026-10-21) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.21.1...6.21.2) ##### Security (SEC) - Avoid repeated full file loads ([#&#8203;4240](https://github.com/py-pdf/pypdf/issues/4240)) - Limit size of standard xref table ([#&#8203;4239](https://github.com/py-pdf/pypdf/issues/4239)) ##### Bug Fixes (BUG) - Decode UniGB-UTF16 CMaps as UTF-16BE ([#&#8203;4231](https://github.com/py-pdf/pypdf/issues/4231)) - Keep 8-bit DeviceRGB image mode ([#&#8203;4230](https://github.com/py-pdf/pypdf/issues/4230)) - Preserve all annotation quadrilaterals when merging pages ([#&#8203;4223](https://github.com/py-pdf/pypdf/issues/4223)) ##### Robustness (ROB) - Multiple fixes [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.21.1...6.21.2) ### [`v6.21.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6212-2026-10-21) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.21.0...6.21.1) ##### Security (SEC) - Avoid repeated full file loads ([#&#8203;4240](https://github.com/py-pdf/pypdf/issues/4240)) - Limit size of standard xref table ([#&#8203;4239](https://github.com/py-pdf/pypdf/issues/4239)) ##### Bug Fixes (BUG) - Decode UniGB-UTF16 CMaps as UTF-16BE ([#&#8203;4231](https://github.com/py-pdf/pypdf/issues/4231)) - Keep 8-bit DeviceRGB image mode ([#&#8203;4230](https://github.com/py-pdf/pypdf/issues/4230)) - Preserve all annotation quadrilaterals when merging pages ([#&#8203;4223](https://github.com/py-pdf/pypdf/issues/4223)) ##### Robustness (ROB) - Multiple fixes [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.21.1...6.21.2) ### [`v6.21.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6211-2026-10-17) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.20.1...6.21.0) ##### Security (SEC) - Only open /DCTDecode image data with the Pillow JPEG plugin ([#&#8203;4222](https://github.com/py-pdf/pypdf/issues/4222)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.21.0...6.21.1) ### [`v6.20.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6210-2026-10-16) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.20.0...6.20.1) ##### Security (SEC) - Improve performance and limit field work ([#&#8203;4219](https://github.com/py-pdf/pypdf/issues/4219)) - Limit stream parsing work ([#&#8203;4218](https://github.com/py-pdf/pypdf/issues/4218)) ##### New Features (ENH) - Allow custom fit modes for named destinations ([#&#8203;4181](https://github.com/py-pdf/pypdf/issues/4181)) ##### Bug Fixes (BUG) - Treat NUL as whitespace in ArrayObject ([#&#8203;4198](https://github.com/py-pdf/pypdf/issues/4198)) - Avoid overwriting unread objects in add\_form\_topname ([#&#8203;4190](https://github.com/py-pdf/pypdf/issues/4190)) - Read an indirect page box on a writer page ([#&#8203;4179](https://github.com/py-pdf/pypdf/issues/4179)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.20.1...6.21.0) ### [`v6.20.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6201-2026-10-12) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.19.0...6.20.0) ##### Security (SEC) - Prevent cyclic tree handling ([#&#8203;4188](https://github.com/py-pdf/pypdf/issues/4188)) ##### Bug Fixes (BUG) - Only read the color operator from a text field's default appearance ([#&#8203;4158](https://github.com/py-pdf/pypdf/issues/4158)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.20.0...6.20.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eSJdfQ==-->
chore(deps): update dependency pypdf to v6.21.1 [security]
Some checks failed
CI / Does this change touch the recording path? (pull_request) Successful in 17s
Details
CI / Which journeys does this change need? (pull_request) Successful in 16s
Details
CI / Bot/backend version sync (pull_request) Successful in 30s
Details
CI / Backend lint (ruff) (pull_request) Successful in 36s
Details
CI / Feedback site tests (pull_request) Successful in 51s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 58s
Details
CI / Bot tests and audit (pull_request) Successful in 2m10s
Details
CI / Docker image build (pull_request) Successful in 4m48s
Details
CI / End-to-end journeys (desktop) (pull_request) Failing after 1m31s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 10m38s
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 14m7s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 16m59s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 57m49s
Details
8f2b36d77a
renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-10-22 00:19:27 +00:00
renovate-bot force-pushed renovate/pypi-pypdf-vulnerability from 8f2b36d77a
Some checks failed
CI / Does this change touch the recording path? (pull_request) Successful in 17s
Details
CI / Which journeys does this change need? (pull_request) Successful in 16s
Details
CI / Bot/backend version sync (pull_request) Successful in 30s
Details
CI / Backend lint (ruff) (pull_request) Successful in 36s
Details
CI / Feedback site tests (pull_request) Successful in 51s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 58s
Details
CI / Bot tests and audit (pull_request) Successful in 2m10s
Details
CI / Docker image build (pull_request) Successful in 4m48s
Details
CI / End-to-end journeys (desktop) (pull_request) Failing after 1m31s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 10m38s
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 14m7s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 16m59s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 57m49s
Details
to 8a2572e100
All checks were successful
CI / Does this change touch the recording path? (pull_request) Successful in 26s
Details
CI / Which journeys does this change need? (pull_request) Successful in 26s
Details
CI / Backend lint (ruff) (pull_request) Successful in 33s
Details
CI / Bot/backend version sync (pull_request) Successful in 57s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m2s
Details
CI / Feedback site tests (pull_request) Successful in 1m38s
Details
CI / Bot tests and audit (pull_request) Successful in 2m4s
Details
CI / Docker image build (pull_request) Successful in 7m57s
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 8m11s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 9m52s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 10m6s
Details
CI / End-to-end journeys (desktop) (pull_request) Successful in 16m56s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 32m17s
Details
2026-10-24 00:16:43 +00:00 Compare
renovate-bot changed title from chore(deps): update dependency pypdf to v6.21.1 [security] to chore(deps): update dependency pypdf to v6.21.2 [security] 2026-10-24 00:16:46 +00:00
renovate-bot deleted branch renovate/pypi-pypdf-vulnerability 2026-10-24 00:49:06 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board!1232
No description provided.