Security Bulletin:Vulnerability in Poppler affects IBM Netezza Appliance

Summary The Poppler package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-10118 Vulnerability Details CVEID:CVE-2026-10118 DESCRIPTION: A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a...

CVE-2026-71870

A flaw was found in pypdf, a pure-python PDF library. A remote attacker could exploit this vulnerability by providing a specially crafted PDF file. When the library attempts to parse unusually large font /ToUnicode CMap streams during text extraction, it can lead to excessive memory consumption...

EUVD-2026-54600

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient recovery of malformed cross-reference streams in crafted PDF files, which allows an attacker to cause excessive processing time and trigger a denial-of-service condition...

EUVD-2026-42344

pypdf: Possible long runtimes for repeated malformed cross-reference entries...

PT-2026-59632

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. Patches This has been fixed in pypdf==6.12.2. Workarounds If you cannot upgrade yet, consider applying the changes...

Uncontrolled Resource Consumption (Infinite Loop)

pypdf is vulnerable to Uncontrolled Resource Consumption Infinite Loop. The vulnerability is due to improper handling of crafted PDF files containing threads/articles during the merge operation, which allows an attacker to trigger an infinite loop by supplying a malicious PDF, resulting in a...

SUSE CVE-2026-59938

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0...

CVE-2026-59937

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0...

PYSEC-2026-1827 pypdf has possible Infinite Loop when processing outlines/bookmarks

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. Patches This has been fixed in pypdf 6.6.2. Workarounds If projects cannot upgrade yet, consider applying the changes from PR 3610...

PYSEC-2026-1830 PyPDF's Manipulated FlateDecode streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. Patches This has been...

PYSEC-2026-1834 Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incomi...

Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop.This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.That is, for example, the case when the pypdf-user manipulates an incoming...

Linux Distros Unpatched Vulnerability : CVE-2026-14404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. Chromium...

CVE-2026-57204

A flaw was found in pypdf, a pure-python PDF library. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when parsed, leads to uncontrolled resource consumption and large memory usage. This occurs because the library sometimes ignores defined limits for stre...

CVE-2026-57204

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAXDECLAREDSTREAMLENGTH is sometimes ignored. This requires parsing a content stream...

CVE-2026-57204

CVE-2026-57204 affects the Python PDF library pypdf. Before version 6.13.3, a malicious PDF can trigger a DoS by causing excessive memory usage when parsing a content stream without a /Length value, due to MAX_DECLARED_STREAM_LENGTH being ignored. The issue is resolved in pypdf 6.13.3. The vulner...

Linux Distros Unpatched Vulnerability : CVE-2026-49461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory...

Amazon Linux 2 : poppler, --advisory ALAS2-2026-3362 (ALAS-2026-3362)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3362 advisory. A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file...