RHLW-2026-8C3FE2E9E5DCB600 Lightwell Security Advisory: pypdf 6.21.1+rhlw.1

Red Hat Lightwell has released pypdf 6.21.1+rhlw.1 with backported fixes for CVE-2026-115585, CVE-2026-115572, and CVE-2026-115580. CVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries Follow-up CVE-2026-115572: pypdf: Possible long runtimes for repeated...

openSUSE 16 Security Update : python-pypdf (openSUSE-SU-2026:22188-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22188-1 advisory. Changes in python-pypdf: - CVE-2026-113786: PDF containing image data labeled with the /DCTDecode filter causes Pillow to select and invoke an...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

[SECURITY] Fedora 45 Update: python-pypdf-6.20.1-1.fc45

pypdf is a free and open-source pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. It can also add custom data, viewing options, and passwords to PDF files. pypdf can retrieve text and metadata from PDFs as well...

SUSE CVE-2026-119203

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream positio...

SUSE CVE-2026-119204

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget,...

SUSE CVE-2026-119205

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycle...

SUSE CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The pagelabels property resolves each page independently and repeatedly scans the same /Num...

SUSE CVE-2026-119207

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

SUSE CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

SUSE CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries...

CVE-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

Fedora 45 : python-pypdf (2026-fffa0647d3)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fffa0647d3 advisory. Update pypdf to 6.20.1. This update fixes several security issues that could let specially crafted PDF files make applications using pypdf hang or use too mu...

Security update for python-pypdf (moderate)

openSUSE security update: security update for python-pypdf ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22188-1 Rating: moderate References: bsc1286632 bsc1286633 bsc1286634 bsc1286635 bsc1286636 bsc1286637 bsc1286638 bsc1286639 Cross-References:...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-119203 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-119203 Source advisory: OSV:GHSA-5849-834G-HVW5...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-119203 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-119203 Source advisory: OSV:GHSA-5849-834G-HVW5...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-119203 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-119203 Source advisory: OSV:GHSA-5849-834G-HVW5...

gpt3discord (>=11.7.3, <=12.3.8) potentially affected by CVE-2026-119203 via pypdf (3.11.1)

pypdf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gpt3discord =11.7.3, =12.3.8 Source cves: CVE-2026-119203 Source advisory: OSV:GHSA-5849-834G-HVW5...

GHSA-5849-834G-HVW5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4289...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-119203 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....