aiagents4pharma (>=1.15.0, <=1.44.0), pypdftotext (>=0.0.6, <=0.0.9) +3 more potentially affected by CVE-2026-59935 via pypdf (5.2.0)

pypdf PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiagents4pharma =1.15.0, =0.0.6, =1.0.1, =1.0.1, =1.0.5 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-59935 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-59935 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-59935 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-59935 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. PatchesThis ha...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-59937 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-59937 Source...

nerxiv (>=0.0.1, <=1.1.0), osfexport (>=0.1.4, <=1.0.1) +3 more potentially affected by CVE-2026-59935 via pypdf (5.7.0)

pypdf PYPI version 5.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - nerxiv =0.0.1, =0.1.4, =0.0.1, =0.3.3, =30.0.8, =30.0.9 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-3613...

athena-starship (>=0.0.3, <=0.0.6), conflare (>=0.1.2, <=0.1.3) +11 more potentially affected by CVE-2026-59937 via pypdf (4.1.0)

pypdf PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - athena-starship =0.0.3, =0.1.2, =2.2.0, =0.0.1, =3.3.0, =1.14.0, =0.1.4, =4.6.2, =0.1.0, =0.1.58 Source cves: CVE-2026-59937 Source advisory:...

criscostack (1.0.0), neumai (>=0.0.9, <=0.0.36) +2 more potentially affected by CVE-2026-59938 via pypdf (3.9.1)

pypdf PYPI version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - criscostack 1.0.0 - neumai =0.0.9, =0.0.17, =2023.6.0, =2024.4.0 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

gpt3discord (>=11.7.3, <=12.3.8) potentially affected by CVE-2026-59938 via pypdf (3.11.1)

pypdf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gpt3discord =11.7.3, =12.3.8 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

PYSEC-2026-3611 pypdf: Possible large memory usage for wrong image dimensions

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-59938 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

calibreweb (0.6.20) potentially affected by CVE-2026-59938 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

pretix (>=4.17.0, <=4.17.1), providentia (2.4.0) potentially affected by CVE-2026-59938 via pypdf (3.4.1)

pypdf PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pretix =4.17.0, =4.17.1 - providentia 2.4.0 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-59938 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

chellow (>=1692799408.0.0, <=1698672999.0.0), pspdfutils (>=3.1.2, <=3.2.0) potentially affected by CVE-2026-59938 via pypdf (3.15.2)

pypdf PYPI version 3.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1692799408.0.0, =3.1.2, =3.2.0 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-59938 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-59938 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-59938 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-59938 Source advisory: OSV:PYSEC-2026-3611...