CVE-2026-119209

The pypdf pure-python PDF library (prior to version 6.21.3 ) is vulnerable to uncontrolled resource consumption (CWE-400, CWE-770). A crafted PDF can trigger excessive memory consumption when opening cross-reference streams that declare very large entry counts. Specifically, highly compressible s...

CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

CVE-2026-119208

The pypdf pure-python PDF library is vulnerable to uncontrolled resource consumption (CWE-400) in versions prior to 6.21.3 . When an application accesses the page count of a crafted encrypted PDF, the library trusts an unvalidated ̄Count value in the page tree instead of walking the tree itself. T...

CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

CVE-2026-119207 pypdf: Possible large memory usage for exceptions in strict mode

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

CVE-2026-119207 pypdf: Possible large memory usage for exceptions in strict mode

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

CVE-2026-119207 pypdf: Possible large memory usage for exceptions in strict mode

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

CVE-2026-119207

The pypdf library, a pure-python PDF library, is vulnerable to uncontrolled resource consumption (CWE-400) and asymmetric resource consumption (CWE-405). Prior to version 6.21.3 , loading a crafted invalid PDF dictionary in strict mode can cause the library to consume excessive memory. This occur...

CVE-2026-119204 pypdf: Possible large memory usage when parsing page tree

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget,...

CVE-2026-119204

The pypdf pure-python PDF library versions prior to 6.21.4 are vulnerable to uncontrolled resource consumption. When parsing a crafted PDF page tree containing numerous shared resources, the library's page-tree flattening process copies page dictionaries and inherited resource entries without a d...

CVE-2026-119204 pypdf: Possible large memory usage when parsing page tree

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget,...

CVE-2026-61846

Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises "SystemStackError: stack level too deep", or can cause excessive memory usage...

bind: BIND: Denial of Service via unbounded processing of crafted DNS messages

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...

GHSA-6JXJ-PX6V-747W Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Summary During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUSCOMPLETED causing the server to repeatedly execute...

PT-2026-132859

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...

PT-2026-132830

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

Google Chrome Microsoft Edge DoS

The HTML component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

PT-2026-123483

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact...