rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 58 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions

chore(deps): update dependency pypdf to v6 [security] - autoclosed #906

Closed
renovate-bot wants to merge 1 commit from renovate/pypi-pypdf-vulnerability into main
pull from: renovate/pypi-pypdf-vulnerability
merge into: rbrooks:main
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-09-28 06:14:20 +00:00
Contributor
Copy link

This PR contains the following updates:

Package Change Age Confidence
pypdf (changelog) ==5.1.0 → ==6.16.1 age confidence

PyPDF's Manipulated FlateDecode streams can exhaust RAM

CVE-2025-55197 / GHSA-7hfw-26vp-jp8m / PYSEC-2026-1830

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access.

Patches

This has been fixed in pypdf==6.0.0.

Workarounds

If you cannot upgrade yet, you might want to implement the workaround for pypdf.filters.decompress yourself: github.com/py-pdf/pypdf@0dd57738bb/pypdf/filters.py (L72-L143)

References

This issue has been reported in #​3429 and fixed in #​3430.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

PyPDF's Manipulated FlateDecode streams can exhaust RAM

CVE-2025-55197 / GHSA-7hfw-26vp-jp8m / PYSEC-2026-1830

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access.

Patches

This has been fixed in pypdf==6.0.0.

Workarounds

If you cannot upgrade yet, you might want to implement the workaround for pypdf.filters.decompress yourself: github.com/py-pdf/pypdf@0dd57738bb/pypdf/filters.py (L72-L143)

References

This issue has been reported in #​3429 and fixed in #​3430.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf can exhaust RAM via manipulated LZWDecode streams

CVE-2025-62708 / GHSA-jfx9-29x2-rv3j / PYSEC-2026-1831

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3502.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf possibly loops infinitely when reading DCT inline images without EOF marker

CVE-2025-62707 / GHSA-vr63-x8vc-m265 / PYSEC-2026-1833

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3501.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf can exhaust RAM via manipulated LZWDecode streams

CVE-2025-62708 / GHSA-jfx9-29x2-rv3j / PYSEC-2026-1831

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3502.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf possibly loops infinitely when reading DCT inline images without EOF marker

CVE-2025-62707 / GHSA-vr63-x8vc-m265 / PYSEC-2026-1833

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3501.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf's LZWDecode streams be manipulated to exhaust RAM

CVE-2025-66019 / GHSA-m449-cwjh-6pw7 / PYSEC-2026-1832

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter.

This is a follow up to GHSA-jfx9-29x2-rv3j to align the default limit with the one for zlib.

Patches

This has been fixed in pypdf==6.4.0.

Workarounds

If users cannot upgrade yet, use the line below to overwrite the default in their code:

pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf's LZWDecode streams be manipulated to exhaust RAM

CVE-2025-66019 / GHSA-m449-cwjh-6pw7 / PYSEC-2026-1832

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter.

This is a follow up to GHSA-jfx9-29x2-rv3j to align the default limit with the one for zlib.

Patches

This has been fixed in pypdf==6.4.0.

Workarounds

If users cannot upgrade yet, use the line below to overwrite the default in their code:

pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes for malformed startxref

CVE-2026-22691 / GHSA-4f6g-68pf-7vhv / PYSEC-2026-1828

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds
from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
Resources

This issue has been fixed in #​3594.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes for missing /Root object with large /Size values

CVE-2026-22690 / GHSA-4xc4-762w-m6cg / PYSEC-2026-1829

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds
from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
Resources

This issue has been fixed in #​3594.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes for malformed startxref

CVE-2026-22691 / GHSA-4f6g-68pf-7vhv / PYSEC-2026-1828

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds
from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
Resources

This issue has been fixed in #​3594.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes for missing /Root object with large /Size values

CVE-2026-22690 / GHSA-4xc4-762w-m6cg / PYSEC-2026-1829

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds
from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
Resources

This issue has been fixed in #​3594.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has possible Infinite Loop when processing outlines/bookmarks

CVE-2026-24688 / GHSA-2q4j-m29v-hq73 / PYSEC-2026-1827

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.

Patches

This has been fixed in pypdf 6.6.2.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3610.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has possible Infinite Loop when processing outlines/bookmarks

CVE-2026-24688 / GHSA-2q4j-m29v-hq73 / PYSEC-2026-1827

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.

Patches

This has been fixed in pypdf 6.6.2.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3610.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has a possible infinite loop when processing TreeObject

CVE-2026-27024 / GHSA-996q-pr4m-cvgq / PYSEC-2026-3013

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3645.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf possibly has long runtimes for malformed FlateDecode streams

CVE-2026-27026 / GHSA-9mvc-8737-8j8h / PYSEC-2026-3015

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3644.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

CVE-2026-27025 / GHSA-wgvp-vg3v-2xq3 / PYSEC-2026-3024

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3646.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has a possible infinite loop when processing TreeObject

CVE-2026-27024 / GHSA-996q-pr4m-cvgq / PYSEC-2026-3013

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3645.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf possibly has long runtimes for malformed FlateDecode streams

CVE-2026-27026 / GHSA-9mvc-8737-8j8h / PYSEC-2026-3015

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3644.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

CVE-2026-27025 / GHSA-wgvp-vg3v-2xq3 / PYSEC-2026-3024

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3646.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

CVE-2026-27628 / GHSA-2rw7-x74f-jg35 / PYSEC-2026-3005

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.

Patches

This has been fixed in pypdf==6.7.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3655.

Severity

  • CVSS Score: 1.2 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

CVE-2026-27628 / GHSA-2rw7-x74f-jg35 / PYSEC-2026-3005

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.

Patches

This has been fixed in pypdf==6.7.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3655.

Severity

  • CVSS Score: 1.2 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

CVE-2026-27888 / GHSA-x7hp-r3qg-r3cj / PYSEC-2026-3027

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode.

Patches

This has been fixed in pypdf==6.7.3.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3658.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

CVE-2026-27888 / GHSA-x7hp-r3qg-r3cj / PYSEC-2026-3027

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode.

Patches

This has been fixed in pypdf==6.7.3.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3658.

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated RunLengthDecode streams can exhaust RAM

CVE-2026-28351 / GHSA-f2v5-7jq9-h8cg / PYSEC-2026-3017

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.

Patches

This has been fixed in pypdf==6.7.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3664.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated RunLengthDecode streams can exhaust RAM

CVE-2026-28351 / GHSA-f2v5-7jq9-h8cg / PYSEC-2026-3017

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.

Patches

This has been fixed in pypdf==6.7.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3664.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

CVE-2026-28804 / GHSA-9m86-7pmv-2852 / PYSEC-2026-3014

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter.

Patches

This has been fixed in pypdf==6.7.5.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3666.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

CVE-2026-28804 / GHSA-9m86-7pmv-2852 / PYSEC-2026-3014

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter.

Patches

This has been fixed in pypdf==6.7.5.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3666.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: manipulated stream length values can exhaust RAM

CVE-2026-31826 / GHSA-hqmh-ppp3-xvm7 / PYSEC-2026-3019

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream.

Patches

This has been fixed in pypdf==6.8.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3675.

As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by open("file.pdf", mode="rb") for example. Passing a file path or a BytesIO buffer to pypdf instead does not seem to trigger the vulnerability.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: manipulated stream length values can exhaust RAM

CVE-2026-31826 / GHSA-hqmh-ppp3-xvm7 / PYSEC-2026-3019

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream.

Patches

This has been fixed in pypdf==6.8.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3675.

As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by open("file.pdf", mode="rb") for example. Passing a file path or a BytesIO buffer to pypdf instead does not seem to trigger the vulnerability.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has inefficient decoding of array-based streams

CVE-2026-33123 / GHSA-qpxp-75px-xjcp / PYSEC-2026-3023

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.

Patches

This has been fixed in pypdf==6.9.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3686.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has inefficient decoding of array-based streams

CVE-2026-33123 / GHSA-qpxp-75px-xjcp / PYSEC-2026-3023

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.

Patches

This has been fixed in pypdf==6.9.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3686.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

CVE-2026-33699 / GHSA-87mj-5ggw-8qc3 / PYSEC-2026-3012

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3693.

Severity

  • CVSS Score: 4.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

CVE-2026-33699 / GHSA-87mj-5ggw-8qc3 / PYSEC-2026-3012

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3693.

Severity

  • CVSS Score: 4.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx / PYSEC-2026-3006

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx / PYSEC-2026-3006

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf has long runtimes for wrong size values in cross-reference and object streams

CVE-2026-41168 / GHSA-jj6c-8h6c-hppx / PYSEC-2026-3021

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has long runtimes for wrong size values in cross-reference and object streams

CVE-2026-41168 / GHSA-jj6c-8h6c-hppx / PYSEC-2026-3021

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for wrong size values in incremental mode

CVE-2026-41313 / GHSA-4pxv-j86v-mhcw / PYSEC-2026-3007

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

CVE-2026-41312 / GHSA-7gw9-cf7v-778f / PYSEC-2026-3011

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

CVE-2026-41314 / GHSA-x284-j5p8-9c5p / PYSEC-2026-3026

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for wrong size values in incremental mode

CVE-2026-41313 / GHSA-4pxv-j86v-mhcw / PYSEC-2026-3007

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

CVE-2026-41312 / GHSA-7gw9-cf7v-778f / PYSEC-2026-3011

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

CVE-2026-41314 / GHSA-x284-j5p8-9c5p / PYSEC-2026-3026

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

CVE-2026-48156 / GHSA-248m-82v9-q6g6 / PYSEC-2026-3004

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #​3791.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for large offsets for layout mode text

CVE-2026-48155 / GHSA-cj93-chg6-vgv8 / PYSEC-2026-3016

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to immediately upgrade, they should consider applying the changes from PR #​3790.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

CVE-2026-48156 / GHSA-248m-82v9-q6g6 / PYSEC-2026-3004

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #​3791.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for large offsets for layout mode text

CVE-2026-48155 / GHSA-cj93-chg6-vgv8 / PYSEC-2026-3016

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to immediately upgrade, they should consider applying the changes from PR #​3790.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Manipulated XMP metadata streams can exhaust RAM

CVE-2026-48735 / GHSA-wjqc-6w8f-h24c / PYSEC-2026-3025

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

Patches

This has been fixed in pypdf==6.12.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3796.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated XMP metadata streams can exhaust RAM

CVE-2026-48735 / GHSA-wjqc-6w8f-h24c / PYSEC-2026-3025

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

Patches

This has been fixed in pypdf==6.12.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3796.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

CVE-2026-49460 / GHSA-5hgr-hg42-57jg / PYSEC-2026-3010

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3806.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for form XObjects during text extraction

CVE-2026-49461 / GHSA-j543-4vmf-qm7v / PYSEC-2026-3020

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3805.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

CVE-2026-49460 / GHSA-5hgr-hg42-57jg / PYSEC-2026-3010

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3806.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for form XObjects during text extraction

CVE-2026-49461 / GHSA-j543-4vmf-qm7v / PYSEC-2026-3020

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3805.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

CVE-2026-54530 / GHSA-52x6-gq3r-vpf4 / PYSEC-2026-3009

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

CVE-2026-54531 / GHSA-m2v9-299j-rv96 / PYSEC-2026-3022

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

CVE-2026-54530 / GHSA-52x6-gq3r-vpf4 / PYSEC-2026-3009

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

CVE-2026-54531 / GHSA-m2v9-299j-rv96 / PYSEC-2026-3022

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when processing threads/articles in writer

CVE-2026-54651 / GHSA-g9xf-7f8q-9mcj / PYSEC-2026-3018

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer.

Patches

This has been fixed in pypdf==6.13.1.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3839.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop when processing threads/articles in writer

CVE-2026-54651 / GHSA-g9xf-7f8q-9mcj / PYSEC-2026-3018

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer.

Patches

This has been fixed in pypdf==6.13.1.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3839.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Missing stream length values ignore defined limits

CVE-2026-57204 / GHSA-jm82-fx9c-mx94

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value.

Patches

This has been fixed in pypdf==6.13.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3871.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for repeated malformed cross-reference entries

CVE-2026-59937 / GHSA-55h5-xmcq-c37v / PYSEC-2026-3610

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3887.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for wrong image dimensions

CVE-2026-59938 / GHSA-5qjq-93h5-hrgp / PYSEC-2026-3611

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3888.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for repeated malformed cross-reference entries

CVE-2026-59937 / GHSA-55h5-xmcq-c37v / PYSEC-2026-3610

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3887.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for wrong image dimensions

CVE-2026-59938 / GHSA-5qjq-93h5-hrgp / PYSEC-2026-3611

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3888.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for not terminated inline images

CVE-2026-59936 / GHSA-5xf7-4p34-54qr / PYSEC-2026-3612

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.

Patches

This has been fixed in pypdf==6.14.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3891.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for not terminated inline images

CVE-2026-59936 / GHSA-5xf7-4p34-54qr / PYSEC-2026-3612

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.

Patches

This has been fixed in pypdf==6.14.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3891.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

CVE-2026-59935 / GHSA-g867-7843-wf8q / PYSEC-2026-3613

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3892.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

CVE-2026-59935 / GHSA-g867-7843-wf8q / PYSEC-2026-3613

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3892.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

CVE-2026-82398 / GHSA-fc8x-2rww-xw9m / PYSEC-2026-3912

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to read_until_whitespace with an input which does not have whitespace for a long time.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3947.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for large /ToUnicode streams

CVE-2026-71870 / GHSA-fp3f-mc75-235c / PYSEC-2026-3655

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3944.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

CVE-2026-71852 / GHSA-fwg2-594c-jp42 / PYSEC-2026-3656

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3946.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible large memory usage for large /ToUnicode streams

CVE-2026-71870 / GHSA-fp3f-mc75-235c / PYSEC-2026-3655

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3944.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

CVE-2026-71852 / GHSA-fwg2-594c-jp42 / PYSEC-2026-3656

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3946.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

CVE-2026-82398 / GHSA-fc8x-2rww-xw9m / PYSEC-2026-3912

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to read_until_whitespace with an input which does not have whitespace for a long time.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3947.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for TreeObject.insert_child

CVE-2026-84309 / GHSA-jp53-mhqp-8xcg / PYSEC-2026-3913

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insert_child is involved.

Patches

This has been fixed in pypdf==6.16.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3964.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible infinite loop for TreeObject.insert_child

CVE-2026-84309 / GHSA-jp53-mhqp-8xcg / PYSEC-2026-3913

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insert_child is involved.

Patches

This has been fixed in pypdf==6.16.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3964.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage when retrieving outlines

CVE-2026-84310 / GHSA-23w6-3w8w-8484 / PYSEC-2026-3910

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3966.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

CVE-2026-84311 / GHSA-763m-79hh-57f2 / PYSEC-2026-3911

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3966.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage when retrieving outlines

CVE-2026-84310 / GHSA-23w6-3w8w-8484 / PYSEC-2026-3910

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3966.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

CVE-2026-84311 / GHSA-763m-79hh-57f2 / PYSEC-2026-3911

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3966.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

py-pdf/pypdf (pypdf)

v6.16.1

Compare Source

Bug Fixes (BUG)
  • Make remove_from_tree() work on outline items (#​3939)
  • Be more lenient about space width in layout mode text extraction (#​3992)
  • Do not scale the text leading by the font size (#​3987)
  • Update annotation appearance stream matrix on page transform (#​3968)
  • Allow repeated page references (#​3959)
Robustness (ROB)
  • Improve RC4 fallback when cryptography can't provide it (#​3853)

Full Changelog

v6.16.0

Compare Source

Security (SEC)
  • Limit iterations for outline retrieval and XForm text extraction (#​3966)

Full Changelog

v6.15.0

Compare Source

Security (SEC)
  • Detect cycles in TreeObject.insert_child (#​3964)
New Features (ENH)
  • AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#​3917)
  • AppearanceStream: Consider more encodings for Type1 core fonts (#​3905)
Performance Improvements (PI)
  • Build /ToUnicode source-code bytes directly in parse_bfrange (#​3952)
Bug Fixes (BUG)
  • Preserve internal Link annotations when appending/merging (#​3953) (#​3954)
  • Fix false inline image end markers (#​3922)
  • Reject typeless non-page /Kids entries in strict mode (#​3955)
  • Apply character spacing (Tc) per glyph in layout-mode extraction (#​3951)
  • Keep the Adobe CMYK inversion when an explicit /Decode is present (#​3943)
Robustness (ROB)
  • AppearanceStream: Only escape parentheses for 8-bit fonts (#​3961)
  • Recover the trailer from a cross-reference stream when rebuilding the xref (#​3950)
Maintenance (MAINT)
  • Deduplicate CatalogAttributes and CatalogDictionary (#​3940)
Code Style (STY)
  • Type pages as a Sequence rather than a list (#​3957)

Full Changelog

v6.14.2

Compare Source

Security (SEC)
  • Improve performance of read_until_whitespace (#​3947)
  • Limit CID width range and width count when loading fonts (#​3946)
  • Limit token length for ToUnicode entries (#​3944)
Deprecations (DEP)
  • Deprecate previously missed inline_images setter as well (#​3897)
New Features (ENH)
  • Add ActualText tag when we produce RTL appearance stream (#​3901)
  • Allow keeping original PDF header in non-incremental clone mode (#​3918)
  • AppearanceStream: Add support for RTL appearance streams with Arabic characters (#​3831)
  • Add actions base class (#​3552)
Bug Fixes (BUG)
  • Expand low-bit samples for images without a filter (#​3938)
  • Decode low-bit DeviceRGB images as RGB instead of palette (#​3929)
  • Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#​3937)
Documentation (DOC)
  • Image and attachment filenames are unsanitized (#​3942)
Maintenance (MAINT)

Full Changelog

v6.14.1

Compare Source

Security (SEC)
  • Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#​3892)

Full Changelog

v6.14.0

Compare Source

Security (SEC)
  • Detect end of stream during inline image end marker detection (#​3891)

Full Changelog

v6.13.3

Compare Source

Security (SEC)
  • Apply general limit for requested image size (#​3888)
  • Speed up recovery when reading broken cross-reference table (#​3887)
New Features (ENH)
  • Check whether image is displayed on a given page (#​3738)
Robustness (ROB)
  • Several fixes

Full Changelog

v6.13.2

Compare Source

Security (SEC)
  • Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#​3871)
Performance Improvements (PI)
  • Avoid per-pixel getpixel loop for 1-bit indexed images (#​3854)
Robustness (ROB)
  • Several fixes
Maintenance (MAINT)
  • Make mypy assert messages consistent (#​3849)

Full Changelog

v6.13.1

Compare Source

Security (SEC)
  • Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#​3847)
Robustness (ROB)
  • Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#​3841)
  • Raise PdfStreamError on non-hexadecimal bytes in hex readers (#​3832)

Full Changelog

v6.13.0

Compare Source

Security (SEC)
  • Prevent infinite loops when processing threads/articles (#​3839)

Full Changelog

v6.12.2

Compare Source

Security (SEC)
  • Avoid infinite loops for outlines and text extraction (#​3830)
New Features (ENH)
  • Add Japanese predefined CMaps (#​3800)
  • Font: Collect all character widths, not only those that can be unicode mapped (#​3798)
Robustness (ROB)
  • Recover a corrupt trailing startxref pointer (closes #​3238) (#​3826)
  • Handle /Pages node without /Kids during flattening (#​3825)
  • Accept inline image EI marker at the end of a content stream (#​3827)
Maintenance (MAINT)
  • Type the always-raising deprecation helpers as NoReturn (#​3819)

Full Changelog

v6.12.1

Compare Source

Security (SEC)
  • Optimize _decode_png_prediction regarding memory and speed (#​3806)
  • Improve loop control in text extraction (#​3805)

Full Changelog

v6.12.0

Compare Source

Security (SEC)
  • Limit input size and element count for XMP metadata (#​3796)
Robustness (ROB)
  • Prevent cyclic parent hierarchies for inherited dictionaries (#​3795)
  • Deal with invalid first code in LZW decoder (#​3794)

Full Changelog

v6.11.0

Compare Source

Security (SEC)
  • Disallow cross-reference streams with zero-only width values (#​3791)
  • Avoid excessive whitespace in layout mode text extraction (#​3790)
New Features (ENH)
  • Implement SASLprep (RFC 4013) for AES-256 password normalization (#​3780)
  • CID font resource from font file to encode more characters (#​3652)
Performance Improvements (PI)
  • Optimize retrieval of named destinatinos in reader (#​3442)
Bug Fixes (BUG)
  • Fix TreeObject.insert_child KeyError on fresh children (#​3786)
Robustness (ROB)
  • AppearanceStream: Also honor user-set font name when not flattening annotations (#​3781)
Documentation (DOC)
  • Block encrypting writer in incremental mode (#​3789)

Full Changelog

v6.10.2

Compare Source

New Features (ENH)
  • Initialise a Font from an embedded font file (#​3704)
Robustness (ROB)
  • Allow to fix AES padding length in non-strict mode (#​3742)
Developer Experience (DEV)
  • Enable PyPy testing again (#​3752)
  • Align mypy Makefile target with strict mode (#​3690)

Full Changelog

v6.10.1

Compare Source

Security (SEC)
  • Do not rely on possibly invalid /Size for incremental cloning (#​3735)
  • Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.0

Compare Source

Security (SEC)
  • Limit the allowed size of xref and object streams (#​3733)
Robustness (ROB)
  • Consider strict mode setting for decryption errors (#​3731)
Documentation (DOC)
  • Use new parameter names for compress_identical_objects

Full Changelog

v6.9.2

Compare Source

Security (SEC)
  • Disallow custom XML entity declarations for XMP metadata (#​3724)
New Features (ENH)
  • Skip MD5 key derivation for AES-256 encrypted PDFs (#​3694)
Bug Fixes (BUG)
  • Use remove_orphans in compress_identical_objects (#​3310)
  • Fix PdfReadError when xref table contains comments before trailer (#​3710)
  • Correctly verify AES padding during decryption (#​3699)
  • Fix stale object cache from non-authoritative object streams (#​3698)
  • Fix extract_links pairing when annotations include non-links (#​3687)
Documentation (DOC)

Full Changelog

v6.9.1

Compare Source

Security (SEC)
  • Avoid infinite loop in read_from_stream for broken files (#​3693)
Robustness (ROB)
  • Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog

v6.9.0

Compare Source

Security (SEC)
  • Improve performance and limit length of array-based content streams (#​3686)

Full Changelog

v6.8.0

Compare Source

New Features (ENH)
  • Expose /Perms verification result on Encryption object (#​3672)
Performance Improvements (PI)
  • Fix O(n²) performance in NameObject read/write (#​3679)
  • Batch-parse all objects in ObjStm on first access (#​3677)
Bug Fixes (BUG)
  • Avoid sharing array-based content streams between pages (#​3681)
  • Avoid accessing invalid page when inserting blank page under some conditions (#​3529)

Full Changelog

v6.7.5

Compare Source

Security (SEC)
  • Limit allowed /Length value of stream (#​3675)
New Features (ENH)
  • Add /IRT (in-reply-to) support for markup annotations (#​3631)
Documentation (DOC)
  • Avoid using PageObject.replace_contents on PdfReader (#​3669)
  • Document how to disable jbig2dec calls

Full Changelog

v6.7.4

Compare Source

Security (SEC)
  • Improve the performance of the ASCIIHexDecode filter (#​3666)

Full Changelog

v6.7.3

Compare Source

Security (SEC)
  • Allow limiting output length for RunLengthDecode filter (#​3664)
Robustness (ROB)
  • Deal with invalid annotations in extract_links (#​3659)

Full Changelog

v6.7.2

Compare Source

Security (SEC)
  • Use zlib decompression limit when retrieving XFA data (#​3658)

Full Changelog

v6.7.1

Compare Source

Security (SEC)
  • Prevent infinite loop from circular xref /Prev references (#​3655)
Bug Fixes (BUG)
  • Fix wrong LUT size error (#​3651)
  • Fix handling of page boxes defined on /Pages (#​3650)

Full Changelog

v6.7.0

Compare Source

Security (SEC)
  • Detect cyclic references when accessing TreeObject.children (#​3645)
  • Limit size of /ToUnicode entries (#​3646)
  • Limit FlateDecode recovery attempts (#​3644)
Bug Fixes (BUG)
  • Avoid own object replacement logic in PageObject.replace_contents (#​3638)
  • Fix UnboundLocalError when update_page_form_field_values with /Sig (#​3634)
Robustness (ROB)
  • Avoid divison by zero when decoding FlateDecode PNG prediction (#​3641)

Full Changelog

v6.6.2

Compare Source

Deprecations (DEP)
  • Deprecate support for abbreviations in decode_stream_data (#​3617)
New Features (ENH)
  • Add ability to add font resources for 14 Adobe Core fonts in text widget annotations (#​3624)
Bug Fixes (BUG)
  • Avoid invalid load for ICCBased FlateDecode images in mode 1 (#​3619)
Robustness (ROB)
  • Fix AESV2 decryption when /Length missing in encrypt dict (#​3629)
  • Fix merging when annotations point to NullObject (#​3613)
  • Check for self._info being None in compress_identical_objects (#​3612)

Full Changelog

v6.6.1

Compare Source

Security (SEC)
  • Detect cyclic references when retrieving outlines (#​3610)

Full Changelog

v6.6.0

Compare Source

Robustness (ROB)
  • /AcroForm might be NullObject (#​3601)
  • Handle missing font bounding boxes gracefully (#​3600)

Full Changelog

v6.5.0

Compare Source

Security (SEC)
  • Improve handling of partially broken PDF files (#​3594)
Deprecations (DEP)
  • Block common page content modifications when assigned to reader (#​3582)
New Features (ENH)
  • Embellishments to generated text appearance streams (#​3571)
Bug Fixes (BUG)
  • Do not consider multi-byte BOM-like sequences as BOMs (#​3589)
Robustness (ROB)
  • Avoid empty FlateDecode outputs without warning (#​3579)
Documentation (DOC)
  • Add outlines documentation and link it in User Guide (#​3511)
Developer Experience (DEV)
  • Add PyPy 3.11 to test matrix and benchmarks (#​3574)
Maintenance (MAINT)
  • Fix compatibility with Pillow >= 12.1.0 (#​3590)

Full Changelog

v6.4.2

Compare Source

New Features (ENH)
  • Limit jbig2dec memory usage (#​3576)
  • FontDescriptor: Initiate from embedded font resource (#​3551)
Robustness (ROB)
  • Allow fallback to PBM files for jbig2dec without PNG support (#​3567)
  • Use warning instead of error for early EOD for RunLengthDecode (#​3548)
Developer Experience (DEV)

Full Changelog

v6.4.1

Compare Source

Bug Fixes (BUG)
  • Fix KeyError when flattening form field without /Font in resources (#​3554)
Robustness (ROB)
  • Allow deleting non-existent annotations (#​3559)
Documentation (DOC)
  • Fix level of attachment heading (#​3560)

Full Changelog

v6.4.0

Compare Source

Performance Improvements (PI)
  • Optimize loop for layout mode text extraction (#​3543)
Bug Fixes (BUG)
  • Do not fail on choice field without /Opt key (#​3540)
Documentation (DOC)
  • Document possible issues with merge_page and clipping (#​3546)
  • Add some notes about library security (#​3545)
Maintenance (MAINT)
  • Use CORE_FONT_METRICS for widths where possible (#​3526)

Full Changelog

v6.3.0

Compare Source

Security (SEC)
  • Reduce default limit for LZW decoding
New Features (ENH)
  • Parse and format comb fields in text widget annotations (#​3519)
Robustness (ROB)
  • Silently ignore Adobe Ascii85 whitespace for suffix detection (#​3528)

Full Changelog

v6.2.0

Compare Source

New Features (ENH)
  • Wrap and align text in flattened PDF forms (#​3465)
Bug Fixes (BUG)
  • Fix missing "PreventGC" when cloning (#​3520)
  • Preserve JPEG image quality by default (#​3516)

Full Changelog

v6.1.3

Compare Source

New Features (ENH)
  • Add 'strict' parameter to PDFWriter (#​3503)
Bug Fixes (BUG)
  • PdfWriter.append fails when there are articles being None (#​3509)
Documentation (DOC)
  • Execute docs examples in CI (#​3507)

Full Changelog

v6.1.2

Compare Source

Security (SEC)
  • Allow limiting size of LZWDecode streams (#​3502)
  • Avoid infinite loop when reading broken DCT-based inline images (#​3501)
Bug Fixes (BUG)
  • PageObject.scale() scales media box incorrectly (#​3489)
Robustness (ROB)
  • Fail with explicit exception when image mode is an empty array (#​3500)

Full Changelog

v6.1.1

Compare Source

Bug Fixes (BUG)
  • Fix handling of zero-length StreamObject (#​3485)
Robustness (ROB)
  • Deal with wrong size for incremental PDF files (#​3495)
  • Improve handling for malformed cross-reference tables (#​3483)
Developer Experience (DEV)
  • Use released Python 3.14
  • Use Mapping instead of dict in type hint of update_page_form_field_values (#​3490)

Full Changelog

v6.1.0

Compare Source

Bug Fixes (BUG)
  • Insert new embedded files in a sorted manner (#​3477)
  • Fix name tree handling for embedded files with Kids-based inputs (#​3475)
  • Make embedding files not break PDF/A-3 compliance (#​3472)
Documentation (DOC)
  • Document AFRelationship handling for PDF/A and provide constants (#​3478)

Full Changelog

v6.0.0

Compare Source

New Features (ENH)
  • Enhance XMP metadata handling with creation and setter methods (#​3410)
  • Add all font metrics for base 14 Type 1 PDF fonts (#​3363)
  • Allow deleting embedded files (#​3461)
  • Add support for Python in FIPS mode for document identifier (#​3438)
Bug Fixes (BUG)
  • Fix handling of UTF-16 encoded destination titles (#​3463)
  • Guard empty input to prevent IndexError (#​3448)
Developer Experience (DEV)
  • Fix type hint for XMP metadata setter to add bytes type (#​3464)

Full Changelog

v5.9.0

Compare Source

Security (SEC)
  • Limit decompressed size for FlateDecode filter (#​3430)
Deprecations (DEP)
New Features (ENH)
  • Move BlackIs1 functionality to tiff_header (#​3421)
Robustness (ROB)
  • Skip Go-To actions without a destination (#​3420)
Developer Experience (DEV)
  • Update code style related libraries (#​3414)
  • Update mypy to 1.17.0 (#​3413)
  • Stop testing on Python 3.8 and start testing on Python 3.14 (#​3411)
Maintenance (MAINT)

Full Changelog

v5.8.0

Compare Source

New Features (ENH)
  • Automatically preserve links in added pages (#​3298)
  • Allow writing/updating all properties of an embedded file (#​3374)
Bug Fixes (BUG)
  • Fix XMP handling dropping indirect references (#​3392)
Robustness (ROB)
  • Deal with DecodeParms being empty list (#​3388)
Documentation (DOC)
  • Document how to read and modify XMP metadata (#​3383)

Full Changelog

v5.7.0

Compare Source

New Features (ENH)
  • Implement flattening for writer (#​3312)
Bug Fixes (BUG)
  • Unterminated object when using PdfWriter with incremental=True (#​3345)
Robustness (ROB)
  • Resolve some image extraction edge cases (#​3371)
  • Ignore faulty trailing newline during RLE decoding (#​3355)
  • Gracefully handle odd-length strings in parse_bfchar (#​3348)
Developer Experience (DEV)
  • Modernize license specifiers (#​3338)
Maintenance (MAINT)
  • Reduce max-complexity of tool.ruff.lint.mccabe (#​3365)
  • Refactor text extraction code

Full Changelog

v5.6.1

Compare Source

Performance Improvements (PI)
  • Performance optimization for LZW decoding (#​3329)
Robustness (ROB)
  • Flate decoding for streams with faulty tail bytes (#​3332)
  • dc_creator could be a Bag as well (#​3333)
  • Handle tree being NullObject when retrieving named destinations (#​3331)
Maintenance (MAINT)
  • Move inline-image mappings to constants (#​3328)

Full Changelog

v5.6.0

Compare Source

New Features (ENH)
  • Add PDF/A XMP metadata support (#​3314)
Robustness (ROB)
  • Deal with annotations not being lists on merge (#​3321)
  • Handle NullObject for cmap encoding Differences entry (#​3317)
Developer Experience (DEV)

Full Changelog

v5.5.0

Compare Source

New Features (ENH)
  • Add basic support for JBIG2 by using jbig2dec (#​3163)
Bug Fixes (BUG)
  • Fix crashes by removing unnecessary line (#​3293)
  • Add delimiters to NameObject.renumber_table (#​3286)
Robustness (ROB)
  • Handle DecodeParms being a NullObject (#​3285)
Code Style (STY)

Full Changelog

v5.4.0

Compare Source

New Features (ENH)
  • Add support for IndirectObject.iter (#​3228)
  • Allow filtering by font when removing text (#​3216)
Bug Fixes (BUG)
  • Add missing named destinations being ByteStringObjects (#​3282)
  • Get font information more reliably when removing text (#​3252)
  • T* 2D Translation consistent with PDF 1.7 Spec (#​3250)
  • Add font stack to q/Q operations in layout mode (#​3225)
  • Avoid completely hiding image loading issues like exceeding image size limits (#​3221)
  • Using compress_identical_objects on transformed content duplicates differing content (#​3197)
  • Consider BlackIs1 parameter for CCITTFaxDecode filter (#​3196)
Robustness (ROB)
  • Deal with insufficient cm matrix during text extraction (#​3283)
  • Allow merging when annotations miss D entry (#​3281)
  • Fix merging documents if there are no Dests (#​3280)
  • Fix crash on malformed action in outline (#​3278)
  • Fix compression issues for removed images which might be None (#​3246)
  • Attempt to deal with non-rectangular FlateDecode streams (#​3245)
  • Handle some None values for broken PDF files (#​3230)
Developer Experience (DEV)
  • Multiple style improvements
  • Update ruff to 0.11.0
Maintenance (MAINT)
  • Conform ASCIIHexDecode implementation to specification (#​3274)
  • Modify comments of filters that do not use decode_parms (#​3260)
Code Style (STY)
  • Simplify warnings & debugging in layout mode text extraction (#​3271)
  • Standardize mypy assert statements (#​3276)

Full Changelog

v5.3.1

Compare Source

New Features (ENH)
  • Add support for IndirectObject.__contains__ (#​3155)
Bug Fixes (BUG)
  • Fix detection of inline images followed by names or numbers (#​3173)
Robustness (ROB)
  • Consider root objects without catalog type as fallback (#​3175)
  • Raise proper error on infinite loop when reading objects (#​3169)
Documentation (DOC)
  • Mention memory consumption of text extraction (#​3168)
Developer Experience (DEV)

Full Changelog

v5.3.0

Compare Source

Bug Fixes (BUG)
  • Use the correct name StandardEncoding for the predefined cmap (#​3156)
  • Handle inline images containing EI sequences (#​3152)
  • Fix check box value which should be name object (#​3124)
  • Fix stream position on inline image fallback extraction (#​3120)
  • Fix object count for incremental writer (#​3117)
Robustness (ROB)
  • Avoid index errors on empty lines in xref table (#​3162)
  • Improve handling of LZW decoder table overflow (#​3159)
  • Ignore non-numbers for width when building font width map (#​3158)
  • Avoid negative seek values when reading partially broken files (#​3157)
Documentation (DOC)
  • Fixed PageObject.images example usage for replacing image (#​3149)

Full Changelog

v5.2.0

Compare Source

New Features (ENH)
  • Handle attachments in /Kids and provide object-oriented API (#​3108)
Bug Fixes (BUG)
  • Handle annotations being None on merging (#​3111)
Robustness (ROB)
  • Prevent excessive layout mode text output from Type3 fonts (#​3082)
Documentation (DOC)
  • stefan6419846 becomes BDFL of pypdf (#​3078)
  • Tidy the visitor function description (#​3086)
Developer Experience (DEV)
  • Remove ignoring multiple Ruff rules
  • Remove unused mutmut configuration (#​3092)
Testing (TST)
  • Fix warning assertions to use pytest.warns() (#​3083)

Full Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pypdf](https://github.com/py-pdf/pypdf) ([changelog](https://pypdf.readthedocs.io/en/latest/meta/CHANGELOG.html)) | `==5.1.0` → `==6.16.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pypdf/6.16.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pypdf/5.1.0/6.16.1?slim=true) | --- ### PyPDF's Manipulated FlateDecode streams can exhaust RAM [CVE-2025-55197](https://nvd.nist.gov/vuln/detail/CVE-2025-55197) / [GHSA-7hfw-26vp-jp8m](https://github.com/advisories/GHSA-7hfw-26vp-jp8m) / PYSEC-2026-1830 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. ##### Patches This has been fixed in [pypdf==6.0.0](https://github.com/py-pdf/pypdf/releases/tag/6.0.0). ##### Workarounds If you cannot upgrade yet, you might want to implement the workaround for `pypdf.filters.decompress` yourself: https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143 ##### References This issue has been reported in #&#8203;3429 and fixed in #&#8203;3430. #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m](https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m) - [https://nvd.nist.gov/vuln/detail/CVE-2025-55197](https://nvd.nist.gov/vuln/detail/CVE-2025-55197) - [https://github.com/py-pdf/pypdf/issues/3429](https://github.com/py-pdf/pypdf/issues/3429) - [https://github.com/py-pdf/pypdf/pull/3430](https://github.com/py-pdf/pypdf/pull/3430) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143](https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143) - [https://github.com/py-pdf/pypdf/releases/tag/6.0.0](https://github.com/py-pdf/pypdf/releases/tag/6.0.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-7hfw-26vp-jp8m) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### PyPDF's Manipulated FlateDecode streams can exhaust RAM [CVE-2025-55197](https://nvd.nist.gov/vuln/detail/CVE-2025-55197) / [GHSA-7hfw-26vp-jp8m](https://github.com/advisories/GHSA-7hfw-26vp-jp8m) / PYSEC-2026-1830 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. ##### Patches This has been fixed in [pypdf==6.0.0](https://github.com/py-pdf/pypdf/releases/tag/6.0.0). ##### Workarounds If you cannot upgrade yet, you might want to implement the workaround for `pypdf.filters.decompress` yourself: https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143 ##### References This issue has been reported in #&#8203;3429 and fixed in #&#8203;3430. #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m](https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m) - [https://nvd.nist.gov/vuln/detail/CVE-2025-55197](https://nvd.nist.gov/vuln/detail/CVE-2025-55197) - [https://github.com/py-pdf/pypdf/issues/3429](https://github.com/py-pdf/pypdf/issues/3429) - [https://github.com/py-pdf/pypdf/pull/3430](https://github.com/py-pdf/pypdf/pull/3430) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143](https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143) - [https://github.com/py-pdf/pypdf/releases/tag/6.0.0](https://github.com/py-pdf/pypdf/releases/tag/6.0.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-7hfw-26vp-jp8m](https://github.com/advisories/GHSA-7hfw-26vp-jp8m) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1830) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf can exhaust RAM via manipulated LZWDecode streams [CVE-2025-62708](https://nvd.nist.gov/vuln/detail/CVE-2025-62708) / [GHSA-jfx9-29x2-rv3j](https://github.com/advisories/GHSA-jfx9-29x2-rv3j) / PYSEC-2026-1831 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. ##### Patches This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3502](https://github.com/py-pdf/pypdf/pull/3502). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) - [https://nvd.nist.gov/vuln/detail/CVE-2025-62708](https://nvd.nist.gov/vuln/detail/CVE-2025-62708) - [https://github.com/py-pdf/pypdf/pull/3502](https://github.com/py-pdf/pypdf/pull/3502) - [https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da](https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jfx9-29x2-rv3j) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf possibly loops infinitely when reading DCT inline images without EOF marker [CVE-2025-62707](https://nvd.nist.gov/vuln/detail/CVE-2025-62707) / [GHSA-vr63-x8vc-m265](https://github.com/advisories/GHSA-vr63-x8vc-m265) / PYSEC-2026-1833 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. ##### Patches This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3501](https://github.com/py-pdf/pypdf/pull/3501). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265](https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265) - [https://nvd.nist.gov/vuln/detail/CVE-2025-62707](https://nvd.nist.gov/vuln/detail/CVE-2025-62707) - [https://github.com/py-pdf/pypdf/pull/3501](https://github.com/py-pdf/pypdf/pull/3501) - [https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8](https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-vr63-x8vc-m265) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf can exhaust RAM via manipulated LZWDecode streams [CVE-2025-62708](https://nvd.nist.gov/vuln/detail/CVE-2025-62708) / [GHSA-jfx9-29x2-rv3j](https://github.com/advisories/GHSA-jfx9-29x2-rv3j) / PYSEC-2026-1831 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. ##### Patches This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3502](https://github.com/py-pdf/pypdf/pull/3502). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) - [https://nvd.nist.gov/vuln/detail/CVE-2025-62708](https://nvd.nist.gov/vuln/detail/CVE-2025-62708) - [https://github.com/py-pdf/pypdf/pull/3502](https://github.com/py-pdf/pypdf/pull/3502) - [https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da](https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-jfx9-29x2-rv3j](https://github.com/advisories/GHSA-jfx9-29x2-rv3j) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1831) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf possibly loops infinitely when reading DCT inline images without EOF marker [CVE-2025-62707](https://nvd.nist.gov/vuln/detail/CVE-2025-62707) / [GHSA-vr63-x8vc-m265](https://github.com/advisories/GHSA-vr63-x8vc-m265) / PYSEC-2026-1833 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. ##### Patches This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3501](https://github.com/py-pdf/pypdf/pull/3501). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265](https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265) - [https://nvd.nist.gov/vuln/detail/CVE-2025-62707](https://nvd.nist.gov/vuln/detail/CVE-2025-62707) - [https://github.com/py-pdf/pypdf/pull/3501](https://github.com/py-pdf/pypdf/pull/3501) - [https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8](https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-vr63-x8vc-m265](https://github.com/advisories/GHSA-vr63-x8vc-m265) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1833) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf's LZWDecode streams be manipulated to exhaust RAM [CVE-2025-66019](https://nvd.nist.gov/vuln/detail/CVE-2025-66019) / [GHSA-m449-cwjh-6pw7](https://github.com/advisories/GHSA-m449-cwjh-6pw7) / PYSEC-2026-1832 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This is a follow up to [GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) to align the default limit with the one for *zlib*. ##### Patches This has been fixed in [pypdf==6.4.0](https://github.com/py-pdf/pypdf/releases/tag/6.4.0). ##### Workarounds If users cannot upgrade yet, use the line below to overwrite the default in their code: ```python pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000 ``` #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7](https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7) - [https://nvd.nist.gov/vuln/detail/CVE-2025-66019](https://nvd.nist.gov/vuln/detail/CVE-2025-66019) - [https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2](https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2) - [https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos](https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.4.0](https://github.com/py-pdf/pypdf/releases/tag/6.4.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m449-cwjh-6pw7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf's LZWDecode streams be manipulated to exhaust RAM [CVE-2025-66019](https://nvd.nist.gov/vuln/detail/CVE-2025-66019) / [GHSA-m449-cwjh-6pw7](https://github.com/advisories/GHSA-m449-cwjh-6pw7) / PYSEC-2026-1832 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This is a follow up to [GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) to align the default limit with the one for *zlib*. ##### Patches This has been fixed in [pypdf==6.4.0](https://github.com/py-pdf/pypdf/releases/tag/6.4.0). ##### Workarounds If users cannot upgrade yet, use the line below to overwrite the default in their code: ```python pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000 ``` #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7](https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7) - [https://nvd.nist.gov/vuln/detail/CVE-2025-66019](https://nvd.nist.gov/vuln/detail/CVE-2025-66019) - [https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2](https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2) - [https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos](https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.4.0](https://github.com/py-pdf/pypdf/releases/tag/6.4.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-m449-cwjh-6pw7](https://github.com/advisories/GHSA-m449-cwjh-6pw7) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1832) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has possible long runtimes for malformed startxref [CVE-2026-22691](https://nvd.nist.gov/vuln/detail/CVE-2026-22691) / [GHSA-4f6g-68pf-7vhv](https://github.com/advisories/GHSA-4f6g-68pf-7vhv) / PYSEC-2026-1828 <details> <summary>More information</summary> #### Details ##### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. ##### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0). ##### Workarounds ```python from pypdf import PdfReader, PdfWriter ##### Instead of reader = PdfReader("file.pdf") ##### use the strict mode: reader = PdfReader("file.pdf", strict=True) ##### Instead of writer = PdfWriter(clone_from="file.pdf") ##### use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ``` ##### Resources This issue has been fixed in #&#8203;3594. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-22691](https://nvd.nist.gov/vuln/detail/CVE-2026-22691) - [https://github.com/py-pdf/pypdf/pull/3594](https://github.com/py-pdf/pypdf/pull/3594) - [https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45](https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4f6g-68pf-7vhv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has possible long runtimes for missing /Root object with large /Size values [CVE-2026-22690](https://nvd.nist.gov/vuln/detail/CVE-2026-22690) / [GHSA-4xc4-762w-m6cg](https://github.com/advisories/GHSA-4xc4-762w-m6cg) / PYSEC-2026-1829 <details> <summary>More information</summary> #### Details ##### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected. ##### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0). ##### Workarounds ```python from pypdf import PdfReader, PdfWriter ##### Instead of reader = PdfReader("file.pdf") ##### use the strict mode: reader = PdfReader("file.pdf", strict=True) ##### Instead of writer = PdfWriter(clone_from="file.pdf") ##### use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ``` ##### Resources This issue has been fixed in #&#8203;3594. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-22690](https://nvd.nist.gov/vuln/detail/CVE-2026-22690) - [https://github.com/py-pdf/pypdf/pull/3594](https://github.com/py-pdf/pypdf/pull/3594) - [https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45](https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4xc4-762w-m6cg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has possible long runtimes for malformed startxref [CVE-2026-22691](https://nvd.nist.gov/vuln/detail/CVE-2026-22691) / [GHSA-4f6g-68pf-7vhv](https://github.com/advisories/GHSA-4f6g-68pf-7vhv) / PYSEC-2026-1828 <details> <summary>More information</summary> #### Details ##### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. ##### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0). ##### Workarounds ```python from pypdf import PdfReader, PdfWriter ##### Instead of reader = PdfReader("file.pdf") ##### use the strict mode: reader = PdfReader("file.pdf", strict=True) ##### Instead of writer = PdfWriter(clone_from="file.pdf") ##### use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ``` ##### Resources This issue has been fixed in #&#8203;3594. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-22691](https://nvd.nist.gov/vuln/detail/CVE-2026-22691) - [https://github.com/py-pdf/pypdf/pull/3594](https://github.com/py-pdf/pypdf/pull/3594) - [https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45](https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-4f6g-68pf-7vhv](https://github.com/advisories/GHSA-4f6g-68pf-7vhv) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1828) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has possible long runtimes for missing /Root object with large /Size values [CVE-2026-22690](https://nvd.nist.gov/vuln/detail/CVE-2026-22690) / [GHSA-4xc4-762w-m6cg](https://github.com/advisories/GHSA-4xc4-762w-m6cg) / PYSEC-2026-1829 <details> <summary>More information</summary> #### Details ##### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected. ##### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0). ##### Workarounds ```python from pypdf import PdfReader, PdfWriter ##### Instead of reader = PdfReader("file.pdf") ##### use the strict mode: reader = PdfReader("file.pdf", strict=True) ##### Instead of writer = PdfWriter(clone_from="file.pdf") ##### use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ``` ##### Resources This issue has been fixed in #&#8203;3594. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-22690](https://nvd.nist.gov/vuln/detail/CVE-2026-22690) - [https://github.com/py-pdf/pypdf/pull/3594](https://github.com/py-pdf/pypdf/pull/3594) - [https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45](https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-4xc4-762w-m6cg](https://github.com/advisories/GHSA-4xc4-762w-m6cg) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1829) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has possible Infinite Loop when processing outlines/bookmarks [CVE-2026-24688](https://nvd.nist.gov/vuln/detail/CVE-2026-24688) / [GHSA-2q4j-m29v-hq73](https://github.com/advisories/GHSA-2q4j-m29v-hq73) / PYSEC-2026-1827 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. ##### Patches This has been fixed in [pypdf 6.6.2](https://github.com/py-pdf/pypdf/releases/tag/6.6.2). ##### Workarounds If projects cannot upgrade yet, consider applying the changes from PR [#&#8203;3610](https://github.com/py-pdf/pypdf/pull/3610). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73](https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73) - [https://nvd.nist.gov/vuln/detail/CVE-2026-24688](https://nvd.nist.gov/vuln/detail/CVE-2026-24688) - [https://github.com/py-pdf/pypdf/pull/3610](https://github.com/py-pdf/pypdf/pull/3610) - [https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1](https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.2](https://github.com/py-pdf/pypdf/releases/tag/6.6.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2q4j-m29v-hq73) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has possible Infinite Loop when processing outlines/bookmarks [CVE-2026-24688](https://nvd.nist.gov/vuln/detail/CVE-2026-24688) / [GHSA-2q4j-m29v-hq73](https://github.com/advisories/GHSA-2q4j-m29v-hq73) / PYSEC-2026-1827 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. ##### Patches This has been fixed in [pypdf 6.6.2](https://github.com/py-pdf/pypdf/releases/tag/6.6.2). ##### Workarounds If projects cannot upgrade yet, consider applying the changes from PR [#&#8203;3610](https://github.com/py-pdf/pypdf/pull/3610). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73](https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73) - [https://nvd.nist.gov/vuln/detail/CVE-2026-24688](https://nvd.nist.gov/vuln/detail/CVE-2026-24688) - [https://github.com/py-pdf/pypdf/pull/3610](https://github.com/py-pdf/pypdf/pull/3610) - [https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1](https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.6.2](https://github.com/py-pdf/pypdf/releases/tag/6.6.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-2q4j-m29v-hq73](https://github.com/advisories/GHSA-2q4j-m29v-hq73) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-1827) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has a possible infinite loop when processing TreeObject [CVE-2026-27024](https://nvd.nist.gov/vuln/detail/CVE-2026-27024) / [GHSA-996q-pr4m-cvgq](https://github.com/advisories/GHSA-996q-pr4m-cvgq) / PYSEC-2026-3013 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a `TreeObject`, for example as part of outlines. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3645](https://github.com/py-pdf/pypdf/pull/3645). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq](https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27024](https://nvd.nist.gov/vuln/detail/CVE-2026-27024) - [https://github.com/py-pdf/pypdf/pull/3645](https://github.com/py-pdf/pypdf/pull/3645) - [https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295](https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-996q-pr4m-cvgq) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf possibly has long runtimes for malformed FlateDecode streams [CVE-2026-27026](https://nvd.nist.gov/vuln/detail/CVE-2026-27026) / [GHSA-9mvc-8737-8j8h](https://github.com/advisories/GHSA-9mvc-8737-8j8h) / PYSEC-2026-3015 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed `/FlateDecode` stream, where the byte-by-byte decompression is used. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3644](https://github.com/py-pdf/pypdf/pull/3644). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h](https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27026](https://nvd.nist.gov/vuln/detail/CVE-2026-27026) - [https://github.com/py-pdf/pypdf/pull/3644](https://github.com/py-pdf/pypdf/pull/3644) - [https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016](https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9mvc-8737-8j8h) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has possible long runtimes/large memory usage for large /ToUnicode streams [CVE-2026-27025](https://nvd.nist.gov/vuln/detail/CVE-2026-27025) / [GHSA-wgvp-vg3v-2xq3](https://github.com/advisories/GHSA-wgvp-vg3v-2xq3) / PYSEC-2026-3024 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3646](https://github.com/py-pdf/pypdf/pull/3646). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3](https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27025](https://nvd.nist.gov/vuln/detail/CVE-2026-27025) - [https://github.com/py-pdf/pypdf/pull/3646](https://github.com/py-pdf/pypdf/pull/3646) - [https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2](https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-wgvp-vg3v-2xq3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has a possible infinite loop when processing TreeObject [CVE-2026-27024](https://nvd.nist.gov/vuln/detail/CVE-2026-27024) / [GHSA-996q-pr4m-cvgq](https://github.com/advisories/GHSA-996q-pr4m-cvgq) / PYSEC-2026-3013 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a `TreeObject`, for example as part of outlines. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3645](https://github.com/py-pdf/pypdf/pull/3645). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq](https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27024](https://nvd.nist.gov/vuln/detail/CVE-2026-27024) - [https://github.com/py-pdf/pypdf/pull/3645](https://github.com/py-pdf/pypdf/pull/3645) - [https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295](https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-996q-pr4m-cvgq](https://github.com/advisories/GHSA-996q-pr4m-cvgq) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3013) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf possibly has long runtimes for malformed FlateDecode streams [CVE-2026-27026](https://nvd.nist.gov/vuln/detail/CVE-2026-27026) / [GHSA-9mvc-8737-8j8h](https://github.com/advisories/GHSA-9mvc-8737-8j8h) / PYSEC-2026-3015 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed `/FlateDecode` stream, where the byte-by-byte decompression is used. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3644](https://github.com/py-pdf/pypdf/pull/3644). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h](https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27026](https://nvd.nist.gov/vuln/detail/CVE-2026-27026) - [https://github.com/py-pdf/pypdf/pull/3644](https://github.com/py-pdf/pypdf/pull/3644) - [https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016](https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-9mvc-8737-8j8h](https://github.com/advisories/GHSA-9mvc-8737-8j8h) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3015) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has possible long runtimes/large memory usage for large /ToUnicode streams [CVE-2026-27025](https://nvd.nist.gov/vuln/detail/CVE-2026-27025) / [GHSA-wgvp-vg3v-2xq3](https://github.com/advisories/GHSA-wgvp-vg3v-2xq3) / PYSEC-2026-3024 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3646](https://github.com/py-pdf/pypdf/pull/3646). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3](https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27025](https://nvd.nist.gov/vuln/detail/CVE-2026-27025) - [https://github.com/py-pdf/pypdf/pull/3646](https://github.com/py-pdf/pypdf/pull/3646) - [https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2](https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-wgvp-vg3v-2xq3](https://github.com/advisories/GHSA-wgvp-vg3v-2xq3) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3024) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams [CVE-2026-27628](https://nvd.nist.gov/vuln/detail/CVE-2026-27628) / [GHSA-2rw7-x74f-jg35](https://github.com/advisories/GHSA-2rw7-x74f-jg35) / PYSEC-2026-3005 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. ##### Patches This has been fixed in [pypdf==6.7.2](https://github.com/py-pdf/pypdf/releases/tag/6.7.2). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3655](https://github.com/py-pdf/pypdf/pull/3655). #### Severity - CVSS Score: 1.2 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35](https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27628](https://nvd.nist.gov/vuln/detail/CVE-2026-27628) - [https://github.com/py-pdf/pypdf/issues/3654](https://github.com/py-pdf/pypdf/issues/3654) - [https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d](https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2rw7-x74f-jg35) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams [CVE-2026-27628](https://nvd.nist.gov/vuln/detail/CVE-2026-27628) / [GHSA-2rw7-x74f-jg35](https://github.com/advisories/GHSA-2rw7-x74f-jg35) / PYSEC-2026-3005 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. ##### Patches This has been fixed in [pypdf==6.7.2](https://github.com/py-pdf/pypdf/releases/tag/6.7.2). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3655](https://github.com/py-pdf/pypdf/pull/3655). #### Severity - CVSS Score: 1.2 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35](https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27628](https://nvd.nist.gov/vuln/detail/CVE-2026-27628) - [https://github.com/py-pdf/pypdf/issues/3654](https://github.com/py-pdf/pypdf/issues/3654) - [https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d](https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-2rw7-x74f-jg35](https://github.com/advisories/GHSA-2rw7-x74f-jg35) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3005) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated FlateDecode XFA streams can exhaust RAM [CVE-2026-27888](https://nvd.nist.gov/vuln/detail/CVE-2026-27888) / [GHSA-x7hp-r3qg-r3cj](https://github.com/advisories/GHSA-x7hp-r3qg-r3cj) / PYSEC-2026-3027 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. ##### Patches This has been fixed in [pypdf==6.7.3](https://github.com/py-pdf/pypdf/releases/tag/6.7.3). ##### Workarounds If projects cannot upgrade yet, consider applying the changes from PR [#&#8203;3658](https://github.com/py-pdf/pypdf/pull/3658). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj](https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27888](https://nvd.nist.gov/vuln/detail/CVE-2026-27888) - [https://github.com/py-pdf/pypdf/pull/3658](https://github.com/py-pdf/pypdf/pull/3658) - [https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c](https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.3](https://github.com/py-pdf/pypdf/releases/tag/6.7.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-x7hp-r3qg-r3cj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated FlateDecode XFA streams can exhaust RAM [CVE-2026-27888](https://nvd.nist.gov/vuln/detail/CVE-2026-27888) / [GHSA-x7hp-r3qg-r3cj](https://github.com/advisories/GHSA-x7hp-r3qg-r3cj) / PYSEC-2026-3027 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. ##### Patches This has been fixed in [pypdf==6.7.3](https://github.com/py-pdf/pypdf/releases/tag/6.7.3). ##### Workarounds If projects cannot upgrade yet, consider applying the changes from PR [#&#8203;3658](https://github.com/py-pdf/pypdf/pull/3658). #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj](https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj) - [https://nvd.nist.gov/vuln/detail/CVE-2026-27888](https://nvd.nist.gov/vuln/detail/CVE-2026-27888) - [https://github.com/py-pdf/pypdf/pull/3658](https://github.com/py-pdf/pypdf/pull/3658) - [https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c](https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.3](https://github.com/py-pdf/pypdf/releases/tag/6.7.3) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-x7hp-r3qg-r3cj](https://github.com/advisories/GHSA-x7hp-r3qg-r3cj) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3027) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated RunLengthDecode streams can exhaust RAM [CVE-2026-28351](https://nvd.nist.gov/vuln/detail/CVE-2026-28351) / [GHSA-f2v5-7jq9-h8cg](https://github.com/advisories/GHSA-f2v5-7jq9-h8cg) / PYSEC-2026-3017 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. ##### Patches This has been fixed in [pypdf==6.7.4](https://github.com/py-pdf/pypdf/releases/tag/6.7.4). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3664](https://github.com/py-pdf/pypdf/pull/3664). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-28351](https://nvd.nist.gov/vuln/detail/CVE-2026-28351) - [https://github.com/py-pdf/pypdf/pull/3664](https://github.com/py-pdf/pypdf/pull/3664) - [https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858](https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.4](https://github.com/py-pdf/pypdf/releases/tag/6.7.4) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f2v5-7jq9-h8cg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated RunLengthDecode streams can exhaust RAM [CVE-2026-28351](https://nvd.nist.gov/vuln/detail/CVE-2026-28351) / [GHSA-f2v5-7jq9-h8cg](https://github.com/advisories/GHSA-f2v5-7jq9-h8cg) / PYSEC-2026-3017 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. ##### Patches This has been fixed in [pypdf==6.7.4](https://github.com/py-pdf/pypdf/releases/tag/6.7.4). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3664](https://github.com/py-pdf/pypdf/pull/3664). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-28351](https://nvd.nist.gov/vuln/detail/CVE-2026-28351) - [https://github.com/py-pdf/pypdf/pull/3664](https://github.com/py-pdf/pypdf/pull/3664) - [https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858](https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.4](https://github.com/py-pdf/pypdf/releases/tag/6.7.4) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-f2v5-7jq9-h8cg](https://github.com/advisories/GHSA-f2v5-7jq9-h8cg) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3017) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams [CVE-2026-28804](https://nvd.nist.gov/vuln/detail/CVE-2026-28804) / [GHSA-9m86-7pmv-2852](https://github.com/advisories/GHSA-9m86-7pmv-2852) / PYSEC-2026-3014 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter. ##### Patches This has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3666](https://github.com/py-pdf/pypdf/pull/3666). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852](https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852) - [https://nvd.nist.gov/vuln/detail/CVE-2026-28804](https://nvd.nist.gov/vuln/detail/CVE-2026-28804) - [https://github.com/py-pdf/pypdf/pull/3666](https://github.com/py-pdf/pypdf/pull/3666) - [https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f](https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9m86-7pmv-2852) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams [CVE-2026-28804](https://nvd.nist.gov/vuln/detail/CVE-2026-28804) / [GHSA-9m86-7pmv-2852](https://github.com/advisories/GHSA-9m86-7pmv-2852) / PYSEC-2026-3014 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter. ##### Patches This has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3666](https://github.com/py-pdf/pypdf/pull/3666). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852](https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852) - [https://nvd.nist.gov/vuln/detail/CVE-2026-28804](https://nvd.nist.gov/vuln/detail/CVE-2026-28804) - [https://github.com/py-pdf/pypdf/pull/3666](https://github.com/py-pdf/pypdf/pull/3666) - [https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f](https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-9m86-7pmv-2852](https://github.com/advisories/GHSA-9m86-7pmv-2852) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3014) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: manipulated stream length values can exhaust RAM [CVE-2026-31826](https://nvd.nist.gov/vuln/detail/CVE-2026-31826) / [GHSA-hqmh-ppp3-xvm7](https://github.com/advisories/GHSA-hqmh-ppp3-xvm7) / PYSEC-2026-3019 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large `/Length` value, regardless of the actual data length inside the stream. ##### Patches This has been fixed in [pypdf==6.8.0](https://github.com/py-pdf/pypdf/releases/tag/6.8.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3675](https://github.com/py-pdf/pypdf/pull/3675). As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by `open("file.pdf", mode="rb")` for example. Passing a file path or a `BytesIO` buffer to *pypdf* instead does not seem to trigger the vulnerability. #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7](https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7) - [https://nvd.nist.gov/vuln/detail/CVE-2026-31826](https://nvd.nist.gov/vuln/detail/CVE-2026-31826) - [https://github.com/py-pdf/pypdf/pull/3675](https://github.com/py-pdf/pypdf/pull/3675) - [https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa](https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.8.0](https://github.com/py-pdf/pypdf/releases/tag/6.8.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-hqmh-ppp3-xvm7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: manipulated stream length values can exhaust RAM [CVE-2026-31826](https://nvd.nist.gov/vuln/detail/CVE-2026-31826) / [GHSA-hqmh-ppp3-xvm7](https://github.com/advisories/GHSA-hqmh-ppp3-xvm7) / PYSEC-2026-3019 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large `/Length` value, regardless of the actual data length inside the stream. ##### Patches This has been fixed in [pypdf==6.8.0](https://github.com/py-pdf/pypdf/releases/tag/6.8.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3675](https://github.com/py-pdf/pypdf/pull/3675). As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by `open("file.pdf", mode="rb")` for example. Passing a file path or a `BytesIO` buffer to *pypdf* instead does not seem to trigger the vulnerability. #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7](https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7) - [https://nvd.nist.gov/vuln/detail/CVE-2026-31826](https://nvd.nist.gov/vuln/detail/CVE-2026-31826) - [https://github.com/py-pdf/pypdf/pull/3675](https://github.com/py-pdf/pypdf/pull/3675) - [https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa](https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.8.0](https://github.com/py-pdf/pypdf/releases/tag/6.8.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-hqmh-ppp3-xvm7](https://github.com/advisories/GHSA-hqmh-ppp3-xvm7) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3019) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has inefficient decoding of array-based streams [CVE-2026-33123](https://nvd.nist.gov/vuln/detail/CVE-2026-33123) / [GHSA-qpxp-75px-xjcp](https://github.com/advisories/GHSA-qpxp-75px-xjcp) / PYSEC-2026-3023 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries. ##### Patches This has been fixed in [pypdf==6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3686](https://github.com/py-pdf/pypdf/pull/3686). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp](https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp) - [https://nvd.nist.gov/vuln/detail/CVE-2026-33123](https://nvd.nist.gov/vuln/detail/CVE-2026-33123) - [https://github.com/py-pdf/pypdf/pull/3686](https://github.com/py-pdf/pypdf/pull/3686) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-qpxp-75px-xjcp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has inefficient decoding of array-based streams [CVE-2026-33123](https://nvd.nist.gov/vuln/detail/CVE-2026-33123) / [GHSA-qpxp-75px-xjcp](https://github.com/advisories/GHSA-qpxp-75px-xjcp) / PYSEC-2026-3023 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries. ##### Patches This has been fixed in [pypdf==6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3686](https://github.com/py-pdf/pypdf/pull/3686). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp](https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp) - [https://nvd.nist.gov/vuln/detail/CVE-2026-33123](https://nvd.nist.gov/vuln/detail/CVE-2026-33123) - [https://github.com/py-pdf/pypdf/pull/3686](https://github.com/py-pdf/pypdf/pull/3686) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-qpxp-75px-xjcp](https://github.com/advisories/GHSA-qpxp-75px-xjcp) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3023) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream [CVE-2026-33699](https://nvd.nist.gov/vuln/detail/CVE-2026-33699) / [GHSA-87mj-5ggw-8qc3](https://github.com/advisories/GHSA-87mj-5ggw-8qc3) / PYSEC-2026-3012 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. ##### Patches This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3693](https://github.com/py-pdf/pypdf/pull/3693). #### Severity - CVSS Score: 4.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3](https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3) - [https://nvd.nist.gov/vuln/detail/CVE-2026-33699](https://nvd.nist.gov/vuln/detail/CVE-2026-33699) - [https://github.com/py-pdf/pypdf/pull/3693](https://github.com/py-pdf/pypdf/pull/3693) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-87mj-5ggw-8qc3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream [CVE-2026-33699](https://nvd.nist.gov/vuln/detail/CVE-2026-33699) / [GHSA-87mj-5ggw-8qc3](https://github.com/advisories/GHSA-87mj-5ggw-8qc3) / PYSEC-2026-3012 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. ##### Patches This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3693](https://github.com/py-pdf/pypdf/pull/3693). #### Severity - CVSS Score: 4.6 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3](https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3) - [https://nvd.nist.gov/vuln/detail/CVE-2026-33699](https://nvd.nist.gov/vuln/detail/CVE-2026-33699) - [https://github.com/py-pdf/pypdf/pull/3693](https://github.com/py-pdf/pypdf/pull/3693) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-87mj-5ggw-8qc3](https://github.com/advisories/GHSA-87mj-5ggw-8qc3) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3012) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated XMP metadata entity declarations can exhaust RAM [CVE-2026-40260](https://nvd.nist.gov/vuln/detail/CVE-2026-40260) / [GHSA-3crg-w4f6-42mx](https://github.com/advisories/GHSA-3crg-w4f6-42mx) / PYSEC-2026-3006 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. ##### Patches This has been fixed in [pypdf==6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3724](https://github.com/py-pdf/pypdf/pull/3724). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx](https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx) - [https://nvd.nist.gov/vuln/detail/CVE-2026-40260](https://nvd.nist.gov/vuln/detail/CVE-2026-40260) - [https://github.com/py-pdf/pypdf/pull/3724](https://github.com/py-pdf/pypdf/pull/3724) - [https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8](https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3crg-w4f6-42mx) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated XMP metadata entity declarations can exhaust RAM [CVE-2026-40260](https://nvd.nist.gov/vuln/detail/CVE-2026-40260) / [GHSA-3crg-w4f6-42mx](https://github.com/advisories/GHSA-3crg-w4f6-42mx) / PYSEC-2026-3006 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. ##### Patches This has been fixed in [pypdf==6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3724](https://github.com/py-pdf/pypdf/pull/3724). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx](https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx) - [https://nvd.nist.gov/vuln/detail/CVE-2026-40260](https://nvd.nist.gov/vuln/detail/CVE-2026-40260) - [https://github.com/py-pdf/pypdf/pull/3724](https://github.com/py-pdf/pypdf/pull/3724) - [https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8](https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-3crg-w4f6-42mx](https://github.com/advisories/GHSA-3crg-w4f6-42mx) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3006) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf has long runtimes for wrong size values in cross-reference and object streams [CVE-2026-41168](https://nvd.nist.gov/vuln/detail/CVE-2026-41168) / [GHSA-jj6c-8h6c-hppx](https://github.com/advisories/GHSA-jj6c-8h6c-hppx) / PYSEC-2026-3021 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ##### Patches This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3733](https://github.com/py-pdf/pypdf/pull/3733). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41168](https://nvd.nist.gov/vuln/detail/CVE-2026-41168) - [https://github.com/py-pdf/pypdf/pull/3733](https://github.com/py-pdf/pypdf/pull/3733) - [https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3](https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jj6c-8h6c-hppx) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf has long runtimes for wrong size values in cross-reference and object streams [CVE-2026-41168](https://nvd.nist.gov/vuln/detail/CVE-2026-41168) / [GHSA-jj6c-8h6c-hppx](https://github.com/advisories/GHSA-jj6c-8h6c-hppx) / PYSEC-2026-3021 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ##### Patches This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3733](https://github.com/py-pdf/pypdf/pull/3733). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41168](https://nvd.nist.gov/vuln/detail/CVE-2026-41168) - [https://github.com/py-pdf/pypdf/pull/3733](https://github.com/py-pdf/pypdf/pull/3733) - [https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3](https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-jj6c-8h6c-hppx](https://github.com/advisories/GHSA-jj6c-8h6c-hppx) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3021) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible long runtimes for wrong size values in incremental mode [CVE-2026-41313](https://nvd.nist.gov/vuln/detail/CVE-2026-41313) / [GHSA-4pxv-j86v-mhcw](https://github.com/advisories/GHSA-4pxv-j86v-mhcw) / PYSEC-2026-3007 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3735](https://github.com/py-pdf/pypdf/pull/3735). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41313](https://nvd.nist.gov/vuln/detail/CVE-2026-41313) - [https://github.com/py-pdf/pypdf/pull/3735](https://github.com/py-pdf/pypdf/pull/3735) - [https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a](https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4pxv-j86v-mhcw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM [CVE-2026-41312](https://nvd.nist.gov/vuln/detail/CVE-2026-41312) / [GHSA-7gw9-cf7v-778f](https://github.com/advisories/GHSA-7gw9-cf7v-778f) / PYSEC-2026-3011 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3734](https://github.com/py-pdf/pypdf/pull/3734). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f](https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41312](https://nvd.nist.gov/vuln/detail/CVE-2026-41312) - [https://github.com/py-pdf/pypdf/pull/3734](https://github.com/py-pdf/pypdf/pull/3734) - [https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11](https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-7gw9-cf7v-778f) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated FlateDecode image dimensions can exhaust RAM [CVE-2026-41314](https://nvd.nist.gov/vuln/detail/CVE-2026-41314) / [GHSA-x284-j5p8-9c5p](https://github.com/advisories/GHSA-x284-j5p8-9c5p) / PYSEC-2026-3026 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3734](https://github.com/py-pdf/pypdf/pull/3734). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p](https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41314](https://nvd.nist.gov/vuln/detail/CVE-2026-41314) - [https://github.com/py-pdf/pypdf/pull/3734](https://github.com/py-pdf/pypdf/pull/3734) - [https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11](https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-x284-j5p8-9c5p) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for wrong size values in incremental mode [CVE-2026-41313](https://nvd.nist.gov/vuln/detail/CVE-2026-41313) / [GHSA-4pxv-j86v-mhcw](https://github.com/advisories/GHSA-4pxv-j86v-mhcw) / PYSEC-2026-3007 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3735](https://github.com/py-pdf/pypdf/pull/3735). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw](https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41313](https://nvd.nist.gov/vuln/detail/CVE-2026-41313) - [https://github.com/py-pdf/pypdf/pull/3735](https://github.com/py-pdf/pypdf/pull/3735) - [https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a](https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-4pxv-j86v-mhcw](https://github.com/advisories/GHSA-4pxv-j86v-mhcw) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3007) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM [CVE-2026-41312](https://nvd.nist.gov/vuln/detail/CVE-2026-41312) / [GHSA-7gw9-cf7v-778f](https://github.com/advisories/GHSA-7gw9-cf7v-778f) / PYSEC-2026-3011 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3734](https://github.com/py-pdf/pypdf/pull/3734). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f](https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41312](https://nvd.nist.gov/vuln/detail/CVE-2026-41312) - [https://github.com/py-pdf/pypdf/pull/3734](https://github.com/py-pdf/pypdf/pull/3734) - [https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11](https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-7gw9-cf7v-778f](https://github.com/advisories/GHSA-7gw9-cf7v-778f) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3011) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated FlateDecode image dimensions can exhaust RAM [CVE-2026-41314](https://nvd.nist.gov/vuln/detail/CVE-2026-41314) / [GHSA-x284-j5p8-9c5p](https://github.com/advisories/GHSA-x284-j5p8-9c5p) / PYSEC-2026-3026 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. ##### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3734](https://github.com/py-pdf/pypdf/pull/3734). #### Severity - CVSS Score: 6.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p](https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41314](https://nvd.nist.gov/vuln/detail/CVE-2026-41314) - [https://github.com/py-pdf/pypdf/pull/3734](https://github.com/py-pdf/pypdf/pull/3734) - [https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11](https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-x284-j5p8-9c5p](https://github.com/advisories/GHSA-x284-j5p8-9c5p) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3026) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams [CVE-2026-48156](https://nvd.nist.gov/vuln/detail/CVE-2026-48156) / [GHSA-248m-82v9-q6g6](https://github.com/advisories/GHSA-248m-82v9-q6g6) / PYSEC-2026-3004 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values. ##### Patches This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0). ##### Workarounds If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR [#&#8203;3791](https://github.com/py-pdf/pypdf/pull/3791). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6](https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48156](https://nvd.nist.gov/vuln/detail/CVE-2026-48156) - [https://github.com/py-pdf/pypdf/pull/3791](https://github.com/py-pdf/pypdf/pull/3791) - [https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70](https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for large offsets for layout mode text [CVE-2026-48155](https://nvd.nist.gov/vuln/detail/CVE-2026-48155) / [GHSA-cj93-chg6-vgv8](https://github.com/advisories/GHSA-cj93-chg6-vgv8) / PYSEC-2026-3016 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. ##### Patches This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0). ##### Workarounds If developers are unable to immediately upgrade, they should consider applying the changes from PR [#&#8203;3790](https://github.com/py-pdf/pypdf/pull/3790). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8](https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48155](https://nvd.nist.gov/vuln/detail/CVE-2026-48155) - [https://github.com/py-pdf/pypdf/pull/3790](https://github.com/py-pdf/pypdf/pull/3790) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-cj93-chg6-vgv8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams [CVE-2026-48156](https://nvd.nist.gov/vuln/detail/CVE-2026-48156) / [GHSA-248m-82v9-q6g6](https://github.com/advisories/GHSA-248m-82v9-q6g6) / PYSEC-2026-3004 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values. ##### Patches This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0). ##### Workarounds If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR [#&#8203;3791](https://github.com/py-pdf/pypdf/pull/3791). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6](https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48156](https://nvd.nist.gov/vuln/detail/CVE-2026-48156) - [https://github.com/py-pdf/pypdf/pull/3791](https://github.com/py-pdf/pypdf/pull/3791) - [https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70](https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-248m-82v9-q6g6](https://github.com/advisories/GHSA-248m-82v9-q6g6) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3004) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible large memory usage for large offsets for layout mode text [CVE-2026-48155](https://nvd.nist.gov/vuln/detail/CVE-2026-48155) / [GHSA-cj93-chg6-vgv8](https://github.com/advisories/GHSA-cj93-chg6-vgv8) / PYSEC-2026-3016 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. ##### Patches This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0). ##### Workarounds If developers are unable to immediately upgrade, they should consider applying the changes from PR [#&#8203;3790](https://github.com/py-pdf/pypdf/pull/3790). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8](https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48155](https://nvd.nist.gov/vuln/detail/CVE-2026-48155) - [https://github.com/py-pdf/pypdf/pull/3790](https://github.com/py-pdf/pypdf/pull/3790) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-cj93-chg6-vgv8](https://github.com/advisories/GHSA-cj93-chg6-vgv8) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3016) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Manipulated XMP metadata streams can exhaust RAM [CVE-2026-48735](https://nvd.nist.gov/vuln/detail/CVE-2026-48735) / [GHSA-wjqc-6w8f-h24c](https://github.com/advisories/GHSA-wjqc-6w8f-h24c) / PYSEC-2026-3025 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. ##### Patches This has been fixed in [pypdf==6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3796](https://github.com/py-pdf/pypdf/pull/3796). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c](https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48735](https://nvd.nist.gov/vuln/detail/CVE-2026-48735) - [https://github.com/py-pdf/pypdf/pull/3796](https://github.com/py-pdf/pypdf/pull/3796) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-wjqc-6w8f-h24c) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Manipulated XMP metadata streams can exhaust RAM [CVE-2026-48735](https://nvd.nist.gov/vuln/detail/CVE-2026-48735) / [GHSA-wjqc-6w8f-h24c](https://github.com/advisories/GHSA-wjqc-6w8f-h24c) / PYSEC-2026-3025 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. ##### Patches This has been fixed in [pypdf==6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3796](https://github.com/py-pdf/pypdf/pull/3796). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c](https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-48735](https://nvd.nist.gov/vuln/detail/CVE-2026-48735) - [https://github.com/py-pdf/pypdf/pull/3796](https://github.com/py-pdf/pypdf/pull/3796) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-wjqc-6w8f-h24c](https://github.com/advisories/GHSA-wjqc-6w8f-h24c) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3025) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Inefficient decoding of FlateDecode PNG predictor streams [CVE-2026-49460](https://nvd.nist.gov/vuln/detail/CVE-2026-49460) / [GHSA-5hgr-hg42-57jg](https://github.com/advisories/GHSA-5hgr-hg42-57jg) / PYSEC-2026-3010 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/FlateDecode` filter with a PNG predictor. ##### Patches This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3806](https://github.com/py-pdf/pypdf/pull/3806). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg) - [https://github.com/py-pdf/pypdf/pull/3806](https://github.com/py-pdf/pypdf/pull/3806) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5hgr-hg42-57jg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for form XObjects during text extraction [CVE-2026-49461](https://nvd.nist.gov/vuln/detail/CVE-2026-49461) / [GHSA-j543-4vmf-qm7v](https://github.com/advisories/GHSA-j543-4vmf-qm7v) / PYSEC-2026-3020 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. ##### Patches This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3805](https://github.com/py-pdf/pypdf/pull/3805). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v](https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v) - [https://github.com/py-pdf/pypdf/pull/3805](https://github.com/py-pdf/pypdf/pull/3805) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-j543-4vmf-qm7v) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Inefficient decoding of FlateDecode PNG predictor streams [CVE-2026-49460](https://nvd.nist.gov/vuln/detail/CVE-2026-49460) / [GHSA-5hgr-hg42-57jg](https://github.com/advisories/GHSA-5hgr-hg42-57jg) / PYSEC-2026-3010 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/FlateDecode` filter with a PNG predictor. ##### Patches This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3806](https://github.com/py-pdf/pypdf/pull/3806). #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg) - [https://github.com/py-pdf/pypdf/pull/3806](https://github.com/py-pdf/pypdf/pull/3806) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-5hgr-hg42-57jg](https://github.com/advisories/GHSA-5hgr-hg42-57jg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-49460](https://nvd.nist.gov/vuln/detail/CVE-2026-49460) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3010) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible large memory usage for form XObjects during text extraction [CVE-2026-49461](https://nvd.nist.gov/vuln/detail/CVE-2026-49461) / [GHSA-j543-4vmf-qm7v](https://github.com/advisories/GHSA-j543-4vmf-qm7v) / PYSEC-2026-3020 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. ##### Patches This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3805](https://github.com/py-pdf/pypdf/pull/3805). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v](https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v) - [https://github.com/py-pdf/pypdf/pull/3805](https://github.com/py-pdf/pypdf/pull/3805) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-j543-4vmf-qm7v](https://github.com/advisories/GHSA-j543-4vmf-qm7v) - [https://nvd.nist.gov/vuln/detail/CVE-2026-49461](https://nvd.nist.gov/vuln/detail/CVE-2026-49461) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3020) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction [CVE-2026-54530](https://nvd.nist.gov/vuln/detail/CVE-2026-54530) / [GHSA-52x6-gq3r-vpf4](https://github.com/advisories/GHSA-52x6-gq3r-vpf4) / PYSEC-2026-3009 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. ##### Patches This has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3830](https://github.com/py-pdf/pypdf/pull/3830). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4](https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4) - [https://github.com/py-pdf/pypdf/pull/3830](https://github.com/py-pdf/pypdf/pull/3830) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-52x6-gq3r-vpf4) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop when processing outlines/bookmarks in writer [CVE-2026-54531](https://nvd.nist.gov/vuln/detail/CVE-2026-54531) / [GHSA-m2v9-299j-rv96](https://github.com/advisories/GHSA-m2v9-299j-rv96) / PYSEC-2026-3022 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. ##### Patches This has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3830](https://github.com/py-pdf/pypdf/pull/3830). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96](https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96) - [https://github.com/py-pdf/pypdf/pull/3830](https://github.com/py-pdf/pypdf/pull/3830) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m2v9-299j-rv96) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction [CVE-2026-54530](https://nvd.nist.gov/vuln/detail/CVE-2026-54530) / [GHSA-52x6-gq3r-vpf4](https://github.com/advisories/GHSA-52x6-gq3r-vpf4) / PYSEC-2026-3009 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. ##### Patches This has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3830](https://github.com/py-pdf/pypdf/pull/3830). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4](https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4) - [https://github.com/py-pdf/pypdf/pull/3830](https://github.com/py-pdf/pypdf/pull/3830) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-52x6-gq3r-vpf4](https://github.com/advisories/GHSA-52x6-gq3r-vpf4) - [https://nvd.nist.gov/vuln/detail/CVE-2026-54530](https://nvd.nist.gov/vuln/detail/CVE-2026-54530) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3009) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop when processing outlines/bookmarks in writer [CVE-2026-54531](https://nvd.nist.gov/vuln/detail/CVE-2026-54531) / [GHSA-m2v9-299j-rv96](https://github.com/advisories/GHSA-m2v9-299j-rv96) / PYSEC-2026-3022 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. ##### Patches This has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3830](https://github.com/py-pdf/pypdf/pull/3830). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96](https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96) - [https://github.com/py-pdf/pypdf/pull/3830](https://github.com/py-pdf/pypdf/pull/3830) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-m2v9-299j-rv96](https://github.com/advisories/GHSA-m2v9-299j-rv96) - [https://nvd.nist.gov/vuln/detail/CVE-2026-54531](https://nvd.nist.gov/vuln/detail/CVE-2026-54531) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3022) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop when processing threads/articles in writer [CVE-2026-54651](https://nvd.nist.gov/vuln/detail/CVE-2026-54651) / [GHSA-g9xf-7f8q-9mcj](https://github.com/advisories/GHSA-g9xf-7f8q-9mcj) / PYSEC-2026-3018 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. ##### Patches This has been fixed in [pypdf==6.13.1](https://github.com/py-pdf/pypdf/releases/tag/6.13.1). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3839](https://github.com/py-pdf/pypdf/pull/3839). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj](https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj) - [https://nvd.nist.gov/vuln/detail/CVE-2026-54651](https://nvd.nist.gov/vuln/detail/CVE-2026-54651) - [https://github.com/py-pdf/pypdf/pull/3839](https://github.com/py-pdf/pypdf/pull/3839) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.1](https://github.com/py-pdf/pypdf/releases/tag/6.13.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-g9xf-7f8q-9mcj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop when processing threads/articles in writer [CVE-2026-54651](https://nvd.nist.gov/vuln/detail/CVE-2026-54651) / [GHSA-g9xf-7f8q-9mcj](https://github.com/advisories/GHSA-g9xf-7f8q-9mcj) / PYSEC-2026-3018 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. ##### Patches This has been fixed in [pypdf==6.13.1](https://github.com/py-pdf/pypdf/releases/tag/6.13.1). ##### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#&#8203;3839](https://github.com/py-pdf/pypdf/pull/3839). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj](https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj) - [https://nvd.nist.gov/vuln/detail/CVE-2026-54651](https://nvd.nist.gov/vuln/detail/CVE-2026-54651) - [https://github.com/py-pdf/pypdf/pull/3839](https://github.com/py-pdf/pypdf/pull/3839) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.1](https://github.com/py-pdf/pypdf/releases/tag/6.13.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-g9xf-7f8q-9mcj](https://github.com/advisories/GHSA-g9xf-7f8q-9mcj) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3018) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Missing stream length values ignore defined limits [CVE-2026-57204](https://nvd.nist.gov/vuln/detail/CVE-2026-57204) / [GHSA-jm82-fx9c-mx94](https://github.com/advisories/GHSA-jm82-fx9c-mx94) <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ##### Patches This has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3871](https://github.com/py-pdf/pypdf/pull/3871). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94) - [https://github.com/py-pdf/pypdf/pull/3871](https://github.com/py-pdf/pypdf/pull/3871) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jm82-fx9c-mx94) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for repeated malformed cross-reference entries [CVE-2026-59937](https://nvd.nist.gov/vuln/detail/CVE-2026-59937) / [GHSA-55h5-xmcq-c37v](https://github.com/advisories/GHSA-55h5-xmcq-c37v) / PYSEC-2026-3610 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. ##### Patches This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3887](https://github.com/py-pdf/pypdf/pull/3887). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v](https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59937](https://nvd.nist.gov/vuln/detail/CVE-2026-59937) - [https://github.com/py-pdf/pypdf/pull/3887](https://github.com/py-pdf/pypdf/pull/3887) - [https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae](https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-55h5-xmcq-c37v) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for wrong image dimensions [CVE-2026-59938](https://nvd.nist.gov/vuln/detail/CVE-2026-59938) / [GHSA-5qjq-93h5-hrgp](https://github.com/advisories/GHSA-5qjq-93h5-hrgp) / PYSEC-2026-3611 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. ##### Patches This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3888](https://github.com/py-pdf/pypdf/pull/3888). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59938](https://nvd.nist.gov/vuln/detail/CVE-2026-59938) - [https://github.com/py-pdf/pypdf/pull/3888](https://github.com/py-pdf/pypdf/pull/3888) - [https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a](https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5qjq-93h5-hrgp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes for repeated malformed cross-reference entries [CVE-2026-59937](https://nvd.nist.gov/vuln/detail/CVE-2026-59937) / [GHSA-55h5-xmcq-c37v](https://github.com/advisories/GHSA-55h5-xmcq-c37v) / PYSEC-2026-3610 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. ##### Patches This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3887](https://github.com/py-pdf/pypdf/pull/3887). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v](https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59937](https://nvd.nist.gov/vuln/detail/CVE-2026-59937) - [https://github.com/py-pdf/pypdf/pull/3887](https://github.com/py-pdf/pypdf/pull/3887) - [https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae](https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-55h5-xmcq-c37v](https://github.com/advisories/GHSA-55h5-xmcq-c37v) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3610) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible large memory usage for wrong image dimensions [CVE-2026-59938](https://nvd.nist.gov/vuln/detail/CVE-2026-59938) / [GHSA-5qjq-93h5-hrgp](https://github.com/advisories/GHSA-5qjq-93h5-hrgp) / PYSEC-2026-3611 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. ##### Patches This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3888](https://github.com/py-pdf/pypdf/pull/3888). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59938](https://nvd.nist.gov/vuln/detail/CVE-2026-59938) - [https://github.com/py-pdf/pypdf/pull/3888](https://github.com/py-pdf/pypdf/pull/3888) - [https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a](https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-5qjq-93h5-hrgp](https://github.com/advisories/GHSA-5qjq-93h5-hrgp) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3611) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop for not terminated inline images [CVE-2026-59936](https://nvd.nist.gov/vuln/detail/CVE-2026-59936) / [GHSA-5xf7-4p34-54qr](https://github.com/advisories/GHSA-5xf7-4p34-54qr) / PYSEC-2026-3612 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. ##### Patches This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3891](https://github.com/py-pdf/pypdf/pull/3891). #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59936](https://nvd.nist.gov/vuln/detail/CVE-2026-59936) - [https://github.com/py-pdf/pypdf/pull/3891](https://github.com/py-pdf/pypdf/pull/3891) - [https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b](https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5xf7-4p34-54qr) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop for not terminated inline images [CVE-2026-59936](https://nvd.nist.gov/vuln/detail/CVE-2026-59936) / [GHSA-5xf7-4p34-54qr](https://github.com/advisories/GHSA-5xf7-4p34-54qr) / PYSEC-2026-3612 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. ##### Patches This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3891](https://github.com/py-pdf/pypdf/pull/3891). #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr](https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59936](https://nvd.nist.gov/vuln/detail/CVE-2026-59936) - [https://github.com/py-pdf/pypdf/pull/3891](https://github.com/py-pdf/pypdf/pull/3891) - [https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b](https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-5xf7-4p34-54qr](https://github.com/advisories/GHSA-5xf7-4p34-54qr) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3612) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) [CVE-2026-59935](https://nvd.nist.gov/vuln/detail/CVE-2026-59935) / [GHSA-g867-7843-wf8q](https://github.com/advisories/GHSA-g867-7843-wf8q) / PYSEC-2026-3613 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. ##### Patches This has been fixed in [pypdf==6.14.2](https://github.com/py-pdf/pypdf/releases/tag/6.14.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3892](https://github.com/py-pdf/pypdf/pull/3892). #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q](https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59935](https://nvd.nist.gov/vuln/detail/CVE-2026-59935) - [https://github.com/py-pdf/pypdf/pull/3892](https://github.com/py-pdf/pypdf/pull/3892) - [https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2](https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.2](https://github.com/py-pdf/pypdf/releases/tag/6.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-g867-7843-wf8q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) [CVE-2026-59935](https://nvd.nist.gov/vuln/detail/CVE-2026-59935) / [GHSA-g867-7843-wf8q](https://github.com/advisories/GHSA-g867-7843-wf8q) / PYSEC-2026-3613 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. ##### Patches This has been fixed in [pypdf==6.14.2](https://github.com/py-pdf/pypdf/releases/tag/6.14.2). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3892](https://github.com/py-pdf/pypdf/pull/3892). #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q](https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59935](https://nvd.nist.gov/vuln/detail/CVE-2026-59935) - [https://github.com/py-pdf/pypdf/pull/3892](https://github.com/py-pdf/pypdf/pull/3892) - [https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2](https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.14.2](https://github.com/py-pdf/pypdf/releases/tag/6.14.2) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-g867-7843-wf8q](https://github.com/advisories/GHSA-g867-7843-wf8q) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3613) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace [CVE-2026-82398](https://nvd.nist.gov/vuln/detail/CVE-2026-82398) / [GHSA-fc8x-2rww-xw9m](https://github.com/advisories/GHSA-fc8x-2rww-xw9m) / PYSEC-2026-3912 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to `read_until_whitespace` with an input which does not have whitespace for a long time. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3947](https://github.com/py-pdf/pypdf/pull/3947). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m) - [https://nvd.nist.gov/vuln/detail/CVE-2026-82398](https://nvd.nist.gov/vuln/detail/CVE-2026-82398) - [https://github.com/py-pdf/pypdf/pull/3947](https://github.com/py-pdf/pypdf/pull/3947) - [https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa](https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fc8x-2rww-xw9m) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for large /ToUnicode streams [CVE-2026-71870](https://nvd.nist.gov/vuln/detail/CVE-2026-71870) / [GHSA-fp3f-mc75-235c](https://github.com/advisories/GHSA-fp3f-mc75-235c) / PYSEC-2026-3655 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3944](https://github.com/py-pdf/pypdf/pull/3944). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c) - [https://github.com/py-pdf/pypdf/pull/3944](https://github.com/py-pdf/pypdf/pull/3944) - [https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa](https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fp3f-mc75-235c) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes/large memory usage for large CID font width ranges [CVE-2026-71852](https://nvd.nist.gov/vuln/detail/CVE-2026-71852) / [GHSA-fwg2-594c-jp42](https://github.com/advisories/GHSA-fwg2-594c-jp42) / PYSEC-2026-3656 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3946](https://github.com/py-pdf/pypdf/pull/3946). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42) - [https://github.com/py-pdf/pypdf/pull/3946](https://github.com/py-pdf/pypdf/pull/3946) - [https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7](https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fwg2-594c-jp42) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible large memory usage for large /ToUnicode streams [CVE-2026-71870](https://nvd.nist.gov/vuln/detail/CVE-2026-71870) / [GHSA-fp3f-mc75-235c](https://github.com/advisories/GHSA-fp3f-mc75-235c) / PYSEC-2026-3655 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3944](https://github.com/py-pdf/pypdf/pull/3944). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c) - [https://github.com/py-pdf/pypdf/pull/3944](https://github.com/py-pdf/pypdf/pull/3944) - [https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa](https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-fp3f-mc75-235c](https://github.com/advisories/GHSA-fp3f-mc75-235c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-71870](https://nvd.nist.gov/vuln/detail/CVE-2026-71870) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3655) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible long runtimes/large memory usage for large CID font width ranges [CVE-2026-71852](https://nvd.nist.gov/vuln/detail/CVE-2026-71852) / [GHSA-fwg2-594c-jp42](https://github.com/advisories/GHSA-fwg2-594c-jp42) / PYSEC-2026-3656 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3946](https://github.com/py-pdf/pypdf/pull/3946). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42) - [https://github.com/py-pdf/pypdf/pull/3946](https://github.com/py-pdf/pypdf/pull/3946) - [https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7](https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-fwg2-594c-jp42](https://github.com/advisories/GHSA-fwg2-594c-jp42) - [https://nvd.nist.gov/vuln/detail/CVE-2026-71852](https://nvd.nist.gov/vuln/detail/CVE-2026-71852) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3656) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace [CVE-2026-82398](https://nvd.nist.gov/vuln/detail/CVE-2026-82398) / [GHSA-fc8x-2rww-xw9m](https://github.com/advisories/GHSA-fc8x-2rww-xw9m) / PYSEC-2026-3912 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to `read_until_whitespace` with an input which does not have whitespace for a long time. ##### Patches This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3947](https://github.com/py-pdf/pypdf/pull/3947). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m) - [https://nvd.nist.gov/vuln/detail/CVE-2026-82398](https://nvd.nist.gov/vuln/detail/CVE-2026-82398) - [https://github.com/py-pdf/pypdf/pull/3947](https://github.com/py-pdf/pypdf/pull/3947) - [https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa](https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-fc8x-2rww-xw9m](https://github.com/advisories/GHSA-fc8x-2rww-xw9m) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3912) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible infinite loop for TreeObject.insert_child [CVE-2026-84309](https://nvd.nist.gov/vuln/detail/CVE-2026-84309) / [GHSA-jp53-mhqp-8xcg](https://github.com/advisories/GHSA-jp53-mhqp-8xcg) / PYSEC-2026-3913 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where `TreeObject.insert_child` is involved. ##### Patches This has been fixed in [pypdf==6.16.0](https://github.com/py-pdf/pypdf/releases/tag/6.16.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3964](https://github.com/py-pdf/pypdf/pull/3964). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg) - [https://github.com/py-pdf/pypdf/pull/3964](https://github.com/py-pdf/pypdf/pull/3964) - [https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b](https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.0](https://github.com/py-pdf/pypdf/releases/tag/6.16.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jp53-mhqp-8xcg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible infinite loop for TreeObject.insert_child [CVE-2026-84309](https://nvd.nist.gov/vuln/detail/CVE-2026-84309) / [GHSA-jp53-mhqp-8xcg](https://github.com/advisories/GHSA-jp53-mhqp-8xcg) / PYSEC-2026-3913 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where `TreeObject.insert_child` is involved. ##### Patches This has been fixed in [pypdf==6.16.0](https://github.com/py-pdf/pypdf/releases/tag/6.16.0). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3964](https://github.com/py-pdf/pypdf/pull/3964). #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg) - [https://github.com/py-pdf/pypdf/pull/3964](https://github.com/py-pdf/pypdf/pull/3964) - [https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b](https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.0](https://github.com/py-pdf/pypdf/releases/tag/6.16.0) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-jp53-mhqp-8xcg](https://github.com/advisories/GHSA-jp53-mhqp-8xcg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84309](https://nvd.nist.gov/vuln/detail/CVE-2026-84309) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3913) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible long runtimes/large memory usage when retrieving outlines [CVE-2026-84310](https://nvd.nist.gov/vuln/detail/CVE-2026-84310) / [GHSA-23w6-3w8w-8484](https://github.com/advisories/GHSA-23w6-3w8w-8484) / PYSEC-2026-3910 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. ##### Patches This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3966](https://github.com/py-pdf/pypdf/pull/3966). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484](https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484) - [https://github.com/py-pdf/pypdf/pull/3966](https://github.com/py-pdf/pypdf/pull/3966) - [https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-23w6-3w8w-8484) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes/large memory usage when extracting XForm objects [CVE-2026-84311](https://nvd.nist.gov/vuln/detail/CVE-2026-84311) / [GHSA-763m-79hh-57f2](https://github.com/advisories/GHSA-763m-79hh-57f2) / PYSEC-2026-3911 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. ##### Patches This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3966](https://github.com/py-pdf/pypdf/pull/3966). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2](https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2) - [https://github.com/py-pdf/pypdf/pull/3966](https://github.com/py-pdf/pypdf/pull/3966) - [https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-763m-79hh-57f2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### pypdf: Possible long runtimes/large memory usage when retrieving outlines [CVE-2026-84310](https://nvd.nist.gov/vuln/detail/CVE-2026-84310) / [GHSA-23w6-3w8w-8484](https://github.com/advisories/GHSA-23w6-3w8w-8484) / PYSEC-2026-3910 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. ##### Patches This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3966](https://github.com/py-pdf/pypdf/pull/3966). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484](https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484) - [https://github.com/py-pdf/pypdf/pull/3966](https://github.com/py-pdf/pypdf/pull/3966) - [https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-23w6-3w8w-8484](https://github.com/advisories/GHSA-23w6-3w8w-8484) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84310](https://nvd.nist.gov/vuln/detail/CVE-2026-84310) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3910) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### pypdf: Possible long runtimes/large memory usage when extracting XForm objects [CVE-2026-84311](https://nvd.nist.gov/vuln/detail/CVE-2026-84311) / [GHSA-763m-79hh-57f2](https://github.com/advisories/GHSA-763m-79hh-57f2) / PYSEC-2026-3911 <details> <summary>More information</summary> #### Details ##### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. ##### Patches This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1). ##### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#&#8203;3966](https://github.com/py-pdf/pypdf/pull/3966). #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2](https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2) - [https://github.com/py-pdf/pypdf/pull/3966](https://github.com/py-pdf/pypdf/pull/3966) - [https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942) - [https://github.com/py-pdf/pypdf](https://github.com/py-pdf/pypdf) - [https://github.com/py-pdf/pypdf/releases/tag/6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1) - [https://pypi.org/project/pypdf](https://pypi.org/project/pypdf) - [https://github.com/advisories/GHSA-763m-79hh-57f2](https://github.com/advisories/GHSA-763m-79hh-57f2) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84311](https://nvd.nist.gov/vuln/detail/CVE-2026-84311) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3911) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### Release Notes <details> <summary>py-pdf/pypdf (pypdf)</summary> ### [`v6.16.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6162-2026-08-23) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.16.0...6.16.1) ##### Bug Fixes (BUG) - Make remove\_from\_tree() work on outline items ([#&#8203;3939](https://github.com/py-pdf/pypdf/issues/3939)) - Be more lenient about space width in layout mode text extraction ([#&#8203;3992](https://github.com/py-pdf/pypdf/issues/3992)) - Do not scale the text leading by the font size ([#&#8203;3987](https://github.com/py-pdf/pypdf/issues/3987)) - Update annotation appearance stream matrix on page transform ([#&#8203;3968](https://github.com/py-pdf/pypdf/issues/3968)) - Allow repeated page references ([#&#8203;3959](https://github.com/py-pdf/pypdf/issues/3959)) ##### Robustness (ROB) - Improve RC4 fallback when cryptography can't provide it ([#&#8203;3853](https://github.com/py-pdf/pypdf/issues/3853)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.16.1...6.16.2) ### [`v6.16.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6161-2026-08-14) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.15.0...6.16.0) ##### Security (SEC) - Limit iterations for outline retrieval and XForm text extraction ([#&#8203;3966](https://github.com/py-pdf/pypdf/issues/3966)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.16.0...6.16.1) ### [`v6.15.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6160-2026-08-13) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.14.2...6.15.0) ##### Security (SEC) - Detect cycles in TreeObject.insert\_child ([#&#8203;3964](https://github.com/py-pdf/pypdf/issues/3964)) ##### New Features (ENH) - AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams ([#&#8203;3917](https://github.com/py-pdf/pypdf/issues/3917)) - AppearanceStream: Consider more encodings for Type1 core fonts ([#&#8203;3905](https://github.com/py-pdf/pypdf/issues/3905)) ##### Performance Improvements (PI) - Build /ToUnicode source-code bytes directly in parse\_bfrange ([#&#8203;3952](https://github.com/py-pdf/pypdf/issues/3952)) ##### Bug Fixes (BUG) - Preserve internal Link annotations when appending/merging ([#&#8203;3953](https://github.com/py-pdf/pypdf/issues/3953)) ([#&#8203;3954](https://github.com/py-pdf/pypdf/issues/3954)) - Fix false inline image end markers ([#&#8203;3922](https://github.com/py-pdf/pypdf/issues/3922)) - Reject typeless non-page /Kids entries in strict mode ([#&#8203;3955](https://github.com/py-pdf/pypdf/issues/3955)) - Apply character spacing (Tc) per glyph in layout-mode extraction ([#&#8203;3951](https://github.com/py-pdf/pypdf/issues/3951)) - Keep the Adobe CMYK inversion when an explicit /Decode is present ([#&#8203;3943](https://github.com/py-pdf/pypdf/issues/3943)) ##### Robustness (ROB) - AppearanceStream: Only escape parentheses for 8-bit fonts ([#&#8203;3961](https://github.com/py-pdf/pypdf/issues/3961)) - Recover the trailer from a cross-reference stream when rebuilding the xref ([#&#8203;3950](https://github.com/py-pdf/pypdf/issues/3950)) ##### Maintenance (MAINT) - Deduplicate CatalogAttributes and CatalogDictionary ([#&#8203;3940](https://github.com/py-pdf/pypdf/issues/3940)) ##### Code Style (STY) - Type pages as a Sequence rather than a list ([#&#8203;3957](https://github.com/py-pdf/pypdf/issues/3957)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.15.0...6.16.0) ### [`v6.14.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6150-2026-08-06) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.14.1...6.14.2) ##### Security (SEC) - Improve performance of read\_until\_whitespace ([#&#8203;3947](https://github.com/py-pdf/pypdf/issues/3947)) - Limit CID width range and width count when loading fonts ([#&#8203;3946](https://github.com/py-pdf/pypdf/issues/3946)) - Limit token length for ToUnicode entries ([#&#8203;3944](https://github.com/py-pdf/pypdf/issues/3944)) ##### Deprecations (DEP) - Deprecate previously missed inline\_images setter as well ([#&#8203;3897](https://github.com/py-pdf/pypdf/issues/3897)) ##### New Features (ENH) - Add ActualText tag when we produce RTL appearance stream ([#&#8203;3901](https://github.com/py-pdf/pypdf/issues/3901)) - Allow keeping original PDF header in non-incremental clone mode ([#&#8203;3918](https://github.com/py-pdf/pypdf/issues/3918)) - AppearanceStream: Add support for RTL appearance streams with Arabic characters ([#&#8203;3831](https://github.com/py-pdf/pypdf/issues/3831)) - Add actions base class ([#&#8203;3552](https://github.com/py-pdf/pypdf/issues/3552)) ##### Bug Fixes (BUG) - Expand low-bit samples for images without a filter ([#&#8203;3938](https://github.com/py-pdf/pypdf/issues/3938)) - Decode low-bit DeviceRGB images as RGB instead of palette ([#&#8203;3929](https://github.com/py-pdf/pypdf/issues/3929)) - Correctly handle IndirectObject in FlateDecode.decode DecodeParms ([#&#8203;3937](https://github.com/py-pdf/pypdf/issues/3937)) ##### Documentation (DOC) - Image and attachment filenames are unsanitized ([#&#8203;3942](https://github.com/py-pdf/pypdf/issues/3942)) ##### Maintenance (MAINT) - Update charset mappings ([#&#8203;3935](https://github.com/py-pdf/pypdf/issues/3935)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.14.2...6.15.0) ### [`v6.14.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6142-2026-06-23) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.14.0...6.14.1) ##### Security (SEC) - Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images ([#&#8203;3892](https://github.com/py-pdf/pypdf/issues/3892)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.14.1...6.14.2) ### [`v6.14.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6141-2026-06-23) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.13.3...6.14.0) ##### Security (SEC) - Detect end of stream during inline image end marker detection ([#&#8203;3891](https://github.com/py-pdf/pypdf/issues/3891)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.14.0...6.14.1) ### [`v6.13.3`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6140-2026-06-22) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3) ##### Security (SEC) - Apply general limit for requested image size ([#&#8203;3888](https://github.com/py-pdf/pypdf/issues/3888)) - Speed up recovery when reading broken cross-reference table ([#&#8203;3887](https://github.com/py-pdf/pypdf/issues/3887)) ##### New Features (ENH) - Check whether image is displayed on a given page ([#&#8203;3738](https://github.com/py-pdf/pypdf/issues/3738)) ##### Robustness (ROB) - Several fixes [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.13.3...6.14.0) ### [`v6.13.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6133-2026-06-17) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2) ##### Security (SEC) - Apply MAX\_DECLARED\_STREAM\_LENGTH to streams without length as well ([#&#8203;3871](https://github.com/py-pdf/pypdf/issues/3871)) ##### Performance Improvements (PI) - Avoid per-pixel getpixel loop for 1-bit indexed images ([#&#8203;3854](https://github.com/py-pdf/pypdf/issues/3854)) ##### Robustness (ROB) - Several fixes ##### Maintenance (MAINT) - Make mypy assert messages consistent ([#&#8203;3849](https://github.com/py-pdf/pypdf/issues/3849)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3) ### [`v6.13.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6132-2026-06-10) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1) ##### Security (SEC) - Detect multi-hop cyclic /Pages trees in \_flatten to prevent SIGSEGV ([#&#8203;3847](https://github.com/py-pdf/pypdf/issues/3847)) ##### Robustness (ROB) - Fix UnboundLocalError in \_read\_standard\_xref\_table on a malformed entry ([#&#8203;3841](https://github.com/py-pdf/pypdf/issues/3841)) - Raise PdfStreamError on non-hexadecimal bytes in hex readers ([#&#8203;3832](https://github.com/py-pdf/pypdf/issues/3832)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2) ### [`v6.13.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6131-2026-06-08) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.12.2...6.13.0) ##### Security (SEC) - Prevent infinite loops when processing threads/articles ([#&#8203;3839](https://github.com/py-pdf/pypdf/issues/3839)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1) ### [`v6.12.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6130-2026-06-05) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.12.1...6.12.2) ##### Security (SEC) - Avoid infinite loops for outlines and text extraction ([#&#8203;3830](https://github.com/py-pdf/pypdf/issues/3830)) ##### New Features (ENH) - Add Japanese predefined CMaps ([#&#8203;3800](https://github.com/py-pdf/pypdf/issues/3800)) - Font: Collect all character widths, not only those that can be unicode mapped ([#&#8203;3798](https://github.com/py-pdf/pypdf/issues/3798)) ##### Robustness (ROB) - Recover a corrupt trailing startxref pointer (closes [#&#8203;3238](https://github.com/py-pdf/pypdf/issues/3238)) ([#&#8203;3826](https://github.com/py-pdf/pypdf/issues/3826)) - Handle /Pages node without /Kids during flattening ([#&#8203;3825](https://github.com/py-pdf/pypdf/issues/3825)) - Accept inline image EI marker at the end of a content stream ([#&#8203;3827](https://github.com/py-pdf/pypdf/issues/3827)) ##### Maintenance (MAINT) - Type the always-raising deprecation helpers as `NoReturn` ([#&#8203;3819](https://github.com/py-pdf/pypdf/issues/3819)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.12.2...6.13.0) ### [`v6.12.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6122-2026-05-26) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.12.0...6.12.1) ##### Security (SEC) - Optimize \_decode\_png\_prediction regarding memory and speed ([#&#8203;3806](https://github.com/py-pdf/pypdf/issues/3806)) - Improve loop control in text extraction ([#&#8203;3805](https://github.com/py-pdf/pypdf/issues/3805)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.12.1...6.12.2) ### [`v6.12.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6121-2026-05-22) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0) ##### Security (SEC) - Limit input size and element count for XMP metadata ([#&#8203;3796](https://github.com/py-pdf/pypdf/issues/3796)) ##### Robustness (ROB) - Prevent cyclic parent hierarchies for inherited dictionaries ([#&#8203;3795](https://github.com/py-pdf/pypdf/issues/3795)) - Deal with invalid first code in LZW decoder ([#&#8203;3794](https://github.com/py-pdf/pypdf/issues/3794)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.12.0...6.12.1) ### [`v6.11.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6120-2026-05-21) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0) ##### Security (SEC) - Disallow cross-reference streams with zero-only width values ([#&#8203;3791](https://github.com/py-pdf/pypdf/issues/3791)) - Avoid excessive whitespace in layout mode text extraction ([#&#8203;3790](https://github.com/py-pdf/pypdf/issues/3790)) ##### New Features (ENH) - Implement SASLprep (RFC 4013) for AES-256 password normalization ([#&#8203;3780](https://github.com/py-pdf/pypdf/issues/3780)) - CID font resource from font file to encode more characters ([#&#8203;3652](https://github.com/py-pdf/pypdf/issues/3652)) ##### Performance Improvements (PI) - Optimize retrieval of named destinatinos in reader ([#&#8203;3442](https://github.com/py-pdf/pypdf/issues/3442)) ##### Bug Fixes (BUG) - Fix TreeObject.insert\_child KeyError on fresh children ([#&#8203;3786](https://github.com/py-pdf/pypdf/issues/3786)) ##### Robustness (ROB) - AppearanceStream: Also honor user-set font name when not flattening annotations ([#&#8203;3781](https://github.com/py-pdf/pypdf/issues/3781)) ##### Documentation (DOC) - Block encrypting writer in incremental mode ([#&#8203;3789](https://github.com/py-pdf/pypdf/issues/3789)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0) ### [`v6.10.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6110-2026-05-09) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.10.1...6.10.2) ##### New Features (ENH) - Initialise a Font from an embedded font file ([#&#8203;3704](https://github.com/py-pdf/pypdf/issues/3704)) ##### Robustness (ROB) - Allow to fix AES padding length in non-strict mode ([#&#8203;3742](https://github.com/py-pdf/pypdf/issues/3742)) ##### Developer Experience (DEV) - Enable PyPy testing again ([#&#8203;3752](https://github.com/py-pdf/pypdf/issues/3752)) - Align mypy Makefile target with strict mode ([#&#8203;3690](https://github.com/py-pdf/pypdf/issues/3690)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0) ### [`v6.10.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6102-2026-04-15) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.10.0...6.10.1) ##### Security (SEC) - Do not rely on possibly invalid /Size for incremental cloning ([#&#8203;3735](https://github.com/py-pdf/pypdf/issues/3735)) - Introduce limits for FlateDecode parameters and image decoding ([#&#8203;3734](https://github.com/py-pdf/pypdf/issues/3734)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.10.1...6.10.2) ### [`v6.10.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6101-2026-04-14) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.9.2...6.10.0) ##### Security (SEC) - Limit the allowed size of xref and object streams ([#&#8203;3733](https://github.com/py-pdf/pypdf/issues/3733)) ##### Robustness (ROB) - Consider strict mode setting for decryption errors ([#&#8203;3731](https://github.com/py-pdf/pypdf/issues/3731)) ##### Documentation (DOC) - Use new parameter names for compress\_identical\_objects [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.10.0...6.10.1) ### [`v6.9.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-6100-2026-04-10) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.9.1...6.9.2) ##### Security (SEC) - Disallow custom XML entity declarations for XMP metadata ([#&#8203;3724](https://github.com/py-pdf/pypdf/issues/3724)) ##### New Features (ENH) - Skip MD5 key derivation for AES-256 encrypted PDFs ([#&#8203;3694](https://github.com/py-pdf/pypdf/issues/3694)) ##### Bug Fixes (BUG) - Use remove\_orphans in compress\_identical\_objects ([#&#8203;3310](https://github.com/py-pdf/pypdf/issues/3310)) - Fix PdfReadError when xref table contains comments before trailer ([#&#8203;3710](https://github.com/py-pdf/pypdf/issues/3710)) - Correctly verify AES padding during decryption ([#&#8203;3699](https://github.com/py-pdf/pypdf/issues/3699)) - Fix stale object cache from non-authoritative object streams ([#&#8203;3698](https://github.com/py-pdf/pypdf/issues/3698)) - Fix extract\_links pairing when annotations include non-links ([#&#8203;3687](https://github.com/py-pdf/pypdf/issues/3687)) ##### Documentation (DOC) - Add AI policy ([#&#8203;3717](https://github.com/py-pdf/pypdf/issues/3717)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.9.2...6.10.0) ### [`v6.9.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-692-2026-03-23) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.9.0...6.9.1) ##### Security (SEC) - Avoid infinite loop in read\_from\_stream for broken files ([#&#8203;3693](https://github.com/py-pdf/pypdf/issues/3693)) ##### Robustness (ROB) - Resolve UnboundLocalError for xobjs in \_get\_image ([#&#8203;3684](https://github.com/py-pdf/pypdf/issues/3684)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.9.1...6.9.2) ### [`v6.9.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-691-2026-03-17) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.8.0...6.9.0) ##### Security (SEC) - Improve performance and limit length of array-based content streams ([#&#8203;3686](https://github.com/py-pdf/pypdf/issues/3686)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.9.0...6.9.1) ### [`v6.8.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-690-2026-03-15) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.5...6.8.0) ##### New Features (ENH) - Expose /Perms verification result on Encryption object ([#&#8203;3672](https://github.com/py-pdf/pypdf/issues/3672)) ##### Performance Improvements (PI) - Fix O(n²) performance in NameObject read/write ([#&#8203;3679](https://github.com/py-pdf/pypdf/issues/3679)) - Batch-parse all objects in ObjStm on first access ([#&#8203;3677](https://github.com/py-pdf/pypdf/issues/3677)) ##### Bug Fixes (BUG) - Avoid sharing array-based content streams between pages ([#&#8203;3681](https://github.com/py-pdf/pypdf/issues/3681)) - Avoid accessing invalid page when inserting blank page under some conditions ([#&#8203;3529](https://github.com/py-pdf/pypdf/issues/3529)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.8.0...6.9.0) ### [`v6.7.5`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-680-2026-03-09) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.4...6.7.5) ##### Security (SEC) - Limit allowed `/Length` value of stream ([#&#8203;3675](https://github.com/py-pdf/pypdf/issues/3675)) ##### New Features (ENH) - Add /IRT (in-reply-to) support for markup annotations ([#&#8203;3631](https://github.com/py-pdf/pypdf/issues/3631)) ##### Documentation (DOC) - Avoid using `PageObject.replace_contents` on PdfReader ([#&#8203;3669](https://github.com/py-pdf/pypdf/issues/3669)) - Document how to disable jbig2dec calls [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.5...6.8.0) ### [`v6.7.4`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-675-2026-03-02) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.3...6.7.4) ##### Security (SEC) - Improve the performance of the ASCIIHexDecode filter ([#&#8203;3666](https://github.com/py-pdf/pypdf/issues/3666)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.4...6.7.5) ### [`v6.7.3`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-674-2026-02-27) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.2...6.7.3) ##### Security (SEC) - Allow limiting output length for RunLengthDecode filter ([#&#8203;3664](https://github.com/py-pdf/pypdf/issues/3664)) ##### Robustness (ROB) - Deal with invalid annotations in extract\_links ([#&#8203;3659](https://github.com/py-pdf/pypdf/issues/3659)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.3...6.7.4) ### [`v6.7.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-673-2026-02-24) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.1...6.7.2) ##### Security (SEC) - Use zlib decompression limit when retrieving XFA data ([#&#8203;3658](https://github.com/py-pdf/pypdf/issues/3658)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.2...6.7.3) ### [`v6.7.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-672-2026-02-22) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.7.0...6.7.1) ##### Security (SEC) - Prevent infinite loop from circular xref /Prev references ([#&#8203;3655](https://github.com/py-pdf/pypdf/issues/3655)) ##### Bug Fixes (BUG) - Fix wrong LUT size error ([#&#8203;3651](https://github.com/py-pdf/pypdf/issues/3651)) - Fix handling of page boxes defined on `/Pages` ([#&#8203;3650](https://github.com/py-pdf/pypdf/issues/3650)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.1...6.7.2) ### [`v6.7.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-671-2026-02-17) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.6.2...6.7.0) ##### Security (SEC) - Detect cyclic references when accessing TreeObject.children ([#&#8203;3645](https://github.com/py-pdf/pypdf/issues/3645)) - Limit size of `/ToUnicode` entries ([#&#8203;3646](https://github.com/py-pdf/pypdf/issues/3646)) - Limit FlateDecode recovery attempts ([#&#8203;3644](https://github.com/py-pdf/pypdf/issues/3644)) ##### Bug Fixes (BUG) - Avoid own object replacement logic in `PageObject.replace_contents` ([#&#8203;3638](https://github.com/py-pdf/pypdf/issues/3638)) - Fix UnboundLocalError when update\_page\_form\_field\_values with /Sig ([#&#8203;3634](https://github.com/py-pdf/pypdf/issues/3634)) ##### Robustness (ROB) - Avoid divison by zero when decoding FlateDecode PNG prediction ([#&#8203;3641](https://github.com/py-pdf/pypdf/issues/3641)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.7.0...6.7.1) ### [`v6.6.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-670-2026-02-08) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.6.1...6.6.2) ##### Deprecations (DEP) - Deprecate support for abbreviations in decode\_stream\_data ([#&#8203;3617](https://github.com/py-pdf/pypdf/issues/3617)) ##### New Features (ENH) - Add ability to add font resources for 14 Adobe Core fonts in text widget annotations ([#&#8203;3624](https://github.com/py-pdf/pypdf/issues/3624)) ##### Bug Fixes (BUG) - Avoid invalid load for ICCBased FlateDecode images in mode 1 ([#&#8203;3619](https://github.com/py-pdf/pypdf/issues/3619)) ##### Robustness (ROB) - Fix AESV2 decryption when /Length missing in encrypt dict ([#&#8203;3629](https://github.com/py-pdf/pypdf/issues/3629)) - Fix merging when annotations point to NullObject ([#&#8203;3613](https://github.com/py-pdf/pypdf/issues/3613)) - Check for `self._info` being None in `compress_identical_objects` ([#&#8203;3612](https://github.com/py-pdf/pypdf/issues/3612)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.6.2...6.7.0) ### [`v6.6.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-662-2026-01-26) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.6.0...6.6.1) ##### Security (SEC) - Detect cyclic references when retrieving outlines ([#&#8203;3610](https://github.com/py-pdf/pypdf/issues/3610)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.6.1...6.6.2) ### [`v6.6.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-661-2026-01-25) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.5.0...6.6.0) ##### Robustness (ROB) - `/AcroForm` might be NullObject ([#&#8203;3601](https://github.com/py-pdf/pypdf/issues/3601)) - Handle missing font bounding boxes gracefully ([#&#8203;3600](https://github.com/py-pdf/pypdf/issues/3600)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.6.0...6.6.1) ### [`v6.5.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-660-2026-01-09) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.4.2...6.5.0) ##### Security (SEC) - Improve handling of partially broken PDF files ([#&#8203;3594](https://github.com/py-pdf/pypdf/issues/3594)) ##### Deprecations (DEP) - Block common page content modifications when assigned to reader ([#&#8203;3582](https://github.com/py-pdf/pypdf/issues/3582)) ##### New Features (ENH) - Embellishments to generated text appearance streams ([#&#8203;3571](https://github.com/py-pdf/pypdf/issues/3571)) ##### Bug Fixes (BUG) - Do not consider multi-byte BOM-like sequences as BOMs ([#&#8203;3589](https://github.com/py-pdf/pypdf/issues/3589)) ##### Robustness (ROB) - Avoid empty FlateDecode outputs without warning ([#&#8203;3579](https://github.com/py-pdf/pypdf/issues/3579)) ##### Documentation (DOC) - Add outlines documentation and link it in User Guide ([#&#8203;3511](https://github.com/py-pdf/pypdf/issues/3511)) ##### Developer Experience (DEV) - Add PyPy 3.11 to test matrix and benchmarks ([#&#8203;3574](https://github.com/py-pdf/pypdf/issues/3574)) ##### Maintenance (MAINT) - Fix compatibility with Pillow >= 12.1.0 ([#&#8203;3590](https://github.com/py-pdf/pypdf/issues/3590)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.5.0...6.6.0) ### [`v6.4.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-650-2025-12-21) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.4.1...6.4.2) ##### New Features (ENH) - Limit jbig2dec memory usage ([#&#8203;3576](https://github.com/py-pdf/pypdf/issues/3576)) - FontDescriptor: Initiate from embedded font resource ([#&#8203;3551](https://github.com/py-pdf/pypdf/issues/3551)) ##### Robustness (ROB) - Allow fallback to PBM files for jbig2dec without PNG support ([#&#8203;3567](https://github.com/py-pdf/pypdf/issues/3567)) - Use warning instead of error for early EOD for RunLengthDecode ([#&#8203;3548](https://github.com/py-pdf/pypdf/issues/3548)) ##### Developer Experience (DEV) - Test with macOS as well ([#&#8203;3401](https://github.com/py-pdf/pypdf/issues/3401)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.4.2...6.5.0) ### [`v6.4.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-642-2025-12-14) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.4.0...6.4.1) ##### Bug Fixes (BUG) - Fix KeyError when flattening form field without /Font in resources ([#&#8203;3554](https://github.com/py-pdf/pypdf/issues/3554)) ##### Robustness (ROB) - Allow deleting non-existent annotations ([#&#8203;3559](https://github.com/py-pdf/pypdf/issues/3559)) ##### Documentation (DOC) - Fix level of attachment heading ([#&#8203;3560](https://github.com/py-pdf/pypdf/issues/3560)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.4.1...6.4.2) ### [`v6.4.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-641-2025-12-07) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.3.0...6.4.0) ##### Performance Improvements (PI) - Optimize loop for layout mode text extraction ([#&#8203;3543](https://github.com/py-pdf/pypdf/issues/3543)) ##### Bug Fixes (BUG) - Do not fail on choice field without /Opt key ([#&#8203;3540](https://github.com/py-pdf/pypdf/issues/3540)) ##### Documentation (DOC) - Document possible issues with merge\_page and clipping ([#&#8203;3546](https://github.com/py-pdf/pypdf/issues/3546)) - Add some notes about library security ([#&#8203;3545](https://github.com/py-pdf/pypdf/issues/3545)) ##### Maintenance (MAINT) - Use CORE\_FONT\_METRICS for widths where possible ([#&#8203;3526](https://github.com/py-pdf/pypdf/issues/3526)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.4.0...6.4.1) ### [`v6.3.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-640-2025-11-23) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.2.0...6.3.0) ##### Security (SEC) - Reduce default limit for LZW decoding ##### New Features (ENH) - Parse and format comb fields in text widget annotations ([#&#8203;3519](https://github.com/py-pdf/pypdf/issues/3519)) ##### Robustness (ROB) - Silently ignore Adobe Ascii85 whitespace for suffix detection ([#&#8203;3528](https://github.com/py-pdf/pypdf/issues/3528)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.3.0...6.4.0) ### [`v6.2.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-630-2025-11-16) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.1.3...6.2.0) ##### New Features (ENH) - Wrap and align text in flattened PDF forms ([#&#8203;3465](https://github.com/py-pdf/pypdf/issues/3465)) ##### Bug Fixes (BUG) - Fix missing "PreventGC" when cloning ([#&#8203;3520](https://github.com/py-pdf/pypdf/issues/3520)) - Preserve JPEG image quality by default ([#&#8203;3516](https://github.com/py-pdf/pypdf/issues/3516)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.2.0...6.3.0) ### [`v6.1.3`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-620-2025-11-09) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.1.2...6.1.3) ##### New Features (ENH) - Add 'strict' parameter to PDFWriter ([#&#8203;3503](https://github.com/py-pdf/pypdf/issues/3503)) ##### Bug Fixes (BUG) - PdfWriter.append fails when there are articles being None ([#&#8203;3509](https://github.com/py-pdf/pypdf/issues/3509)) ##### Documentation (DOC) - Execute docs examples in CI ([#&#8203;3507](https://github.com/py-pdf/pypdf/issues/3507)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.1.3...6.2.0) ### [`v6.1.2`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-613-2025-10-22) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.1.1...6.1.2) ##### Security (SEC) - Allow limiting size of LZWDecode streams ([#&#8203;3502](https://github.com/py-pdf/pypdf/issues/3502)) - Avoid infinite loop when reading broken DCT-based inline images ([#&#8203;3501](https://github.com/py-pdf/pypdf/issues/3501)) ##### Bug Fixes (BUG) - PageObject.scale() scales media box incorrectly ([#&#8203;3489](https://github.com/py-pdf/pypdf/issues/3489)) ##### Robustness (ROB) - Fail with explicit exception when image mode is an empty array ([#&#8203;3500](https://github.com/py-pdf/pypdf/issues/3500)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.1.2...6.1.3) ### [`v6.1.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-612-2025-10-19) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.1.0...6.1.1) ##### Bug Fixes (BUG) - Fix handling of zero-length StreamObject ([#&#8203;3485](https://github.com/py-pdf/pypdf/issues/3485)) ##### Robustness (ROB) - Deal with wrong size for incremental PDF files ([#&#8203;3495](https://github.com/py-pdf/pypdf/issues/3495)) - Improve handling for malformed cross-reference tables ([#&#8203;3483](https://github.com/py-pdf/pypdf/issues/3483)) ##### Developer Experience (DEV) - Use released Python 3.14 - Use Mapping instead of dict in type hint of update\_page\_form\_field\_values ([#&#8203;3490](https://github.com/py-pdf/pypdf/issues/3490)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.1.1...6.1.2) ### [`v6.1.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-611-2025-09-28) [Compare Source](https://github.com/py-pdf/pypdf/compare/6.0.0...6.1.0) ##### Bug Fixes (BUG) - Insert new embedded files in a sorted manner ([#&#8203;3477](https://github.com/py-pdf/pypdf/issues/3477)) - Fix name tree handling for embedded files with Kids-based inputs ([#&#8203;3475](https://github.com/py-pdf/pypdf/issues/3475)) - Make embedding files not break PDF/A-3 compliance ([#&#8203;3472](https://github.com/py-pdf/pypdf/issues/3472)) ##### Documentation (DOC) - Document AFRelationship handling for PDF/A and provide constants ([#&#8203;3478](https://github.com/py-pdf/pypdf/issues/3478)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.1.0...6.1.1) ### [`v6.0.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-610-2025-09-21) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.9.0...6.0.0) ##### New Features (ENH) - Enhance XMP metadata handling with creation and setter methods ([#&#8203;3410](https://github.com/py-pdf/pypdf/issues/3410)) - Add all font metrics for base 14 Type 1 PDF fonts ([#&#8203;3363](https://github.com/py-pdf/pypdf/issues/3363)) - Allow deleting embedded files ([#&#8203;3461](https://github.com/py-pdf/pypdf/issues/3461)) - Add support for Python in FIPS mode for document identifier ([#&#8203;3438](https://github.com/py-pdf/pypdf/issues/3438)) ##### Bug Fixes (BUG) - Fix handling of UTF-16 encoded destination titles ([#&#8203;3463](https://github.com/py-pdf/pypdf/issues/3463)) - Guard empty input to prevent IndexError ([#&#8203;3448](https://github.com/py-pdf/pypdf/issues/3448)) ##### Developer Experience (DEV) - Fix type hint for XMP metadata setter to add bytes type ([#&#8203;3464](https://github.com/py-pdf/pypdf/issues/3464)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/6.0.0...6.1.0) ### [`v5.9.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-600-2025-08-11) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.8.0...5.9.0) ##### Security (SEC) - Limit decompressed size for FlateDecode filter ([#&#8203;3430](https://github.com/py-pdf/pypdf/issues/3430)) ##### Deprecations (DEP) - Drop Python 3.8 support ([#&#8203;3412](https://github.com/py-pdf/pypdf/issues/3412)) ##### New Features (ENH) - Move BlackIs1 functionality to tiff\_header ([#&#8203;3421](https://github.com/py-pdf/pypdf/issues/3421)) ##### Robustness (ROB) - Skip Go-To actions without a destination ([#&#8203;3420](https://github.com/py-pdf/pypdf/issues/3420)) ##### Developer Experience (DEV) - Update code style related libraries ([#&#8203;3414](https://github.com/py-pdf/pypdf/issues/3414)) - Update mypy to 1.17.0 ([#&#8203;3413](https://github.com/py-pdf/pypdf/issues/3413)) - Stop testing on Python 3.8 and start testing on Python 3.14 ([#&#8203;3411](https://github.com/py-pdf/pypdf/issues/3411)) ##### Maintenance (MAINT) - Cleanup deprecations ([#&#8203;3424](https://github.com/py-pdf/pypdf/issues/3424)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.9.0...6.0.0) ### [`v5.8.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-590-2025-07-27) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.7.0...5.8.0) ##### New Features (ENH) - Automatically preserve links in added pages ([#&#8203;3298](https://github.com/py-pdf/pypdf/issues/3298)) - Allow writing/updating all properties of an embedded file ([#&#8203;3374](https://github.com/py-pdf/pypdf/issues/3374)) ##### Bug Fixes (BUG) - Fix XMP handling dropping indirect references ([#&#8203;3392](https://github.com/py-pdf/pypdf/issues/3392)) ##### Robustness (ROB) - Deal with DecodeParms being empty list ([#&#8203;3388](https://github.com/py-pdf/pypdf/issues/3388)) ##### Documentation (DOC) - Document how to read and modify XMP metadata ([#&#8203;3383](https://github.com/py-pdf/pypdf/issues/3383)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.8.0...5.9.0) ### [`v5.7.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-580-2025-07-13) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.6.1...5.7.0) ##### New Features (ENH) - Implement flattening for writer ([#&#8203;3312](https://github.com/py-pdf/pypdf/issues/3312)) ##### Bug Fixes (BUG) - Unterminated object when using PdfWriter with incremental=True ([#&#8203;3345](https://github.com/py-pdf/pypdf/issues/3345)) ##### Robustness (ROB) - Resolve some image extraction edge cases ([#&#8203;3371](https://github.com/py-pdf/pypdf/issues/3371)) - Ignore faulty trailing newline during RLE decoding ([#&#8203;3355](https://github.com/py-pdf/pypdf/issues/3355)) - Gracefully handle odd-length strings in parse\_bfchar ([#&#8203;3348](https://github.com/py-pdf/pypdf/issues/3348)) ##### Developer Experience (DEV) - Modernize license specifiers ([#&#8203;3338](https://github.com/py-pdf/pypdf/issues/3338)) ##### Maintenance (MAINT) - Reduce max-complexity of tool.ruff.lint.mccabe ([#&#8203;3365](https://github.com/py-pdf/pypdf/issues/3365)) - Refactor text extraction code [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.7.0...5.8.0) ### [`v5.6.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-570-2025-06-29) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.6.0...5.6.1) ##### Performance Improvements (PI) - Performance optimization for LZW decoding ([#&#8203;3329](https://github.com/py-pdf/pypdf/issues/3329)) ##### Robustness (ROB) - Flate decoding for streams with faulty tail bytes ([#&#8203;3332](https://github.com/py-pdf/pypdf/issues/3332)) - dc\_creator could be a Bag as well ([#&#8203;3333](https://github.com/py-pdf/pypdf/issues/3333)) - Handle tree being NullObject when retrieving named destinations ([#&#8203;3331](https://github.com/py-pdf/pypdf/issues/3331)) ##### Maintenance (MAINT) - Move inline-image mappings to constants ([#&#8203;3328](https://github.com/py-pdf/pypdf/issues/3328)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.6.1...5.7.0) ### [`v5.6.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-561-2025-06-22) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.5.0...5.6.0) ##### New Features (ENH) - Add PDF/A XMP metadata support ([#&#8203;3314](https://github.com/py-pdf/pypdf/issues/3314)) ##### Robustness (ROB) - Deal with annotations not being lists on merge ([#&#8203;3321](https://github.com/py-pdf/pypdf/issues/3321)) - Handle NullObject for cmap encoding Differences entry ([#&#8203;3317](https://github.com/py-pdf/pypdf/issues/3317)) ##### Developer Experience (DEV) - Update ruff to 0.12.0 ([#&#8203;3316](https://github.com/py-pdf/pypdf/issues/3316)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.6.0...5.6.1) ### [`v5.5.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-560-2025-06-01) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.4.0...5.5.0) ##### New Features (ENH) - Add basic support for JBIG2 by using jbig2dec ([#&#8203;3163](https://github.com/py-pdf/pypdf/issues/3163)) ##### Bug Fixes (BUG) - Fix crashes by removing unnecessary line ([#&#8203;3293](https://github.com/py-pdf/pypdf/issues/3293)) - Add delimiters to NameObject.renumber\_table ([#&#8203;3286](https://github.com/py-pdf/pypdf/issues/3286)) ##### Robustness (ROB) - Handle DecodeParms being a NullObject ([#&#8203;3285](https://github.com/py-pdf/pypdf/issues/3285)) ##### Code Style (STY) - Update to mypy 1.16.0 ([#&#8203;3300](https://github.com/py-pdf/pypdf/issues/3300)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.5.0...5.6.0) ### [`v5.4.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-550-2025-05-11) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.3.1...5.4.0) ##### New Features (ENH) - Add support for IndirectObject.**iter** ([#&#8203;3228](https://github.com/py-pdf/pypdf/issues/3228)) - Allow filtering by font when removing text ([#&#8203;3216](https://github.com/py-pdf/pypdf/issues/3216)) ##### Bug Fixes (BUG) - Add missing named destinations being ByteStringObjects ([#&#8203;3282](https://github.com/py-pdf/pypdf/issues/3282)) - Get font information more reliably when removing text ([#&#8203;3252](https://github.com/py-pdf/pypdf/issues/3252)) - T\* 2D Translation consistent with PDF 1.7 Spec ([#&#8203;3250](https://github.com/py-pdf/pypdf/issues/3250)) - Add font stack to q/Q operations in layout mode ([#&#8203;3225](https://github.com/py-pdf/pypdf/issues/3225)) - Avoid completely hiding image loading issues like exceeding image size limits ([#&#8203;3221](https://github.com/py-pdf/pypdf/issues/3221)) - Using compress\_identical\_objects on transformed content duplicates differing content ([#&#8203;3197](https://github.com/py-pdf/pypdf/issues/3197)) - Consider BlackIs1 parameter for CCITTFaxDecode filter ([#&#8203;3196](https://github.com/py-pdf/pypdf/issues/3196)) ##### Robustness (ROB) - Deal with insufficient cm matrix during text extraction ([#&#8203;3283](https://github.com/py-pdf/pypdf/issues/3283)) - Allow merging when annotations miss D entry ([#&#8203;3281](https://github.com/py-pdf/pypdf/issues/3281)) - Fix merging documents if there are no Dests ([#&#8203;3280](https://github.com/py-pdf/pypdf/issues/3280)) - Fix crash on malformed action in outline ([#&#8203;3278](https://github.com/py-pdf/pypdf/issues/3278)) - Fix compression issues for removed images which might be None ([#&#8203;3246](https://github.com/py-pdf/pypdf/issues/3246)) - Attempt to deal with non-rectangular FlateDecode streams ([#&#8203;3245](https://github.com/py-pdf/pypdf/issues/3245)) - Handle some None values for broken PDF files ([#&#8203;3230](https://github.com/py-pdf/pypdf/issues/3230)) ##### Developer Experience (DEV) - Multiple style improvements - Update ruff to 0.11.0 ##### Maintenance (MAINT) - Conform ASCIIHexDecode implementation to specification ([#&#8203;3274](https://github.com/py-pdf/pypdf/issues/3274)) - Modify comments of filters that do not use decode\_parms ([#&#8203;3260](https://github.com/py-pdf/pypdf/issues/3260)) ##### Code Style (STY) - Simplify warnings & debugging in layout mode text extraction ([#&#8203;3271](https://github.com/py-pdf/pypdf/issues/3271)) - Standardize mypy assert statements ([#&#8203;3276](https://github.com/py-pdf/pypdf/issues/3276)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.4.0...5.5.0) ### [`v5.3.1`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-540-2025-03-16) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.3.0...5.3.1) ##### New Features (ENH) - Add support for `IndirectObject.__contains__` ([#&#8203;3155](https://github.com/py-pdf/pypdf/issues/3155)) ##### Bug Fixes (BUG) - Fix detection of inline images followed by names or numbers ([#&#8203;3173](https://github.com/py-pdf/pypdf/issues/3173)) ##### Robustness (ROB) - Consider root objects without catalog type as fallback ([#&#8203;3175](https://github.com/py-pdf/pypdf/issues/3175)) - Raise proper error on infinite loop when reading objects ([#&#8203;3169](https://github.com/py-pdf/pypdf/issues/3169)) ##### Documentation (DOC) - Mention memory consumption of text extraction ([#&#8203;3168](https://github.com/py-pdf/pypdf/issues/3168)) ##### Developer Experience (DEV) - Upgrade to ruff 0.10.0 ([#&#8203;3191](https://github.com/py-pdf/pypdf/issues/3191)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.3.1...5.4.0) ### [`v5.3.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-531-2025-03-02) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.2.0...5.3.0) ##### Bug Fixes (BUG) - Use the correct name StandardEncoding for the predefined cmap ([#&#8203;3156](https://github.com/py-pdf/pypdf/issues/3156)) - Handle inline images containing `EI ` sequences ([#&#8203;3152](https://github.com/py-pdf/pypdf/issues/3152)) - Fix check box value which should be name object ([#&#8203;3124](https://github.com/py-pdf/pypdf/issues/3124)) - Fix stream position on inline image fallback extraction ([#&#8203;3120](https://github.com/py-pdf/pypdf/issues/3120)) - Fix object count for incremental writer ([#&#8203;3117](https://github.com/py-pdf/pypdf/issues/3117)) ##### Robustness (ROB) - Avoid index errors on empty lines in xref table ([#&#8203;3162](https://github.com/py-pdf/pypdf/issues/3162)) - Improve handling of LZW decoder table overflow ([#&#8203;3159](https://github.com/py-pdf/pypdf/issues/3159)) - Ignore non-numbers for width when building font width map ([#&#8203;3158](https://github.com/py-pdf/pypdf/issues/3158)) - Avoid negative seek values when reading partially broken files ([#&#8203;3157](https://github.com/py-pdf/pypdf/issues/3157)) ##### Documentation (DOC) - Fixed PageObject.images example usage for replacing image ([#&#8203;3149](https://github.com/py-pdf/pypdf/issues/3149)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.3.0...5.3.1) ### [`v5.2.0`](https://github.com/py-pdf/pypdf/blob/HEAD/CHANGELOG.md#Version-530-2025-02-09) [Compare Source](https://github.com/py-pdf/pypdf/compare/5.1.0...5.2.0) ##### New Features (ENH) - Handle attachments in /Kids and provide object-oriented API ([#&#8203;3108](https://github.com/py-pdf/pypdf/issues/3108)) ##### Bug Fixes (BUG) - Handle annotations being None on merging ([#&#8203;3111](https://github.com/py-pdf/pypdf/issues/3111)) ##### Robustness (ROB) - Prevent excessive layout mode text output from Type3 fonts ([#&#8203;3082](https://github.com/py-pdf/pypdf/issues/3082)) ##### Documentation (DOC) - stefan6419846 becomes BDFL of pypdf ([#&#8203;3078](https://github.com/py-pdf/pypdf/issues/3078)) - Tidy the visitor function description ([#&#8203;3086](https://github.com/py-pdf/pypdf/issues/3086)) ##### Developer Experience (DEV) - Remove ignoring multiple Ruff rules - Remove unused mutmut configuration ([#&#8203;3092](https://github.com/py-pdf/pypdf/issues/3092)) ##### Testing (TST) - Fix warning assertions to use `pytest.warns()` ([#&#8203;3083](https://github.com/py-pdf/pypdf/issues/3083)) [Full Changelog](https://github.com/py-pdf/pypdf/compare/5.2.0...5.3.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eSJdfQ==-->
chore(deps): update dependency pypdf to v6 [security]
All checks were successful
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m9s
Details
CI / Backend lint (ruff) (pull_request) Successful in 35s
Details
CI / Bot/backend version sync (pull_request) Successful in 27s
Details
CI / Feedback site tests (pull_request) Successful in 42s
Details
CI / Does this change touch the recording path? (pull_request) Successful in 23s
Details
CI / Bot tests and audit (pull_request) Successful in 4m26s
Details
CI / Docker image build (pull_request) Successful in 5m4s
Details
CI / Frontend tests, audit, and build (pull_request) Successful in 21m27s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 46m33s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 18m1s
Details
CI / End-to-end journeys (desktop, phone, keyboard-only) (pull_request) Successful in 26m5s
Details
fec1323b22
renovate-bot changed title from chore(deps): update dependency pypdf to v6 [security] to chore(deps): update dependency pypdf to v6 [security] - autoclosed 2026-09-29 12:31:30 +00:00
renovate-bot closed this pull request 2026-09-29 12:31:31 +00:00
All checks were successful
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m9s
Required
Details
CI / Backend lint (ruff) (pull_request) Successful in 35s
Required
Details
CI / Bot/backend version sync (pull_request) Successful in 27s
Required
Details
CI / Feedback site tests (pull_request) Successful in 42s
Required
Details
CI / Does this change touch the recording path? (pull_request) Successful in 23s
Required
Details
CI / Bot tests and audit (pull_request) Successful in 4m26s
Required
Details
CI / Docker image build (pull_request) Successful in 5m4s
Required
Details
CI / Frontend tests, audit, and build (pull_request) Successful in 21m27s
Required
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 46m33s
Required
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 18m1s
Required
Details
CI / End-to-end journeys (desktop, phone, keyboard-only) (pull_request) Successful in 26m5s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board!906
No description provided.