PT-2026-75208

TuxCare rebuilt pypdf to address 2 CVEs. Fixed in 5.9.0.post7+tuxcare...

PT-2026-73571

TuxCare rebuilt pypdf to address 1 CVE. Fixed in 5.9.0.post1+tuxcare...

PT-2026-75060

TuxCare rebuilt pypdf to address 3 CVEs. Fixed in 5.9.0.post6+tuxcare...

pypdf CVE-2026-24688 circular outline DoS PDF

Generates a malicious PDF with circular outline/bookmark references A→B→A or nested /First cycle. Vulnerable pypdf str: return text.replace"\", "\\".replace"", "\".replace"", "\" def writepdfpath: Path, objects: list - None: """Write a minimal PDF with a correct xref table 1-indexed...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient recovery of malformed cross-reference streams in crafted PDF files, which allows an attacker to cause excessive processing time and trigger a denial-of-service condition...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service DoS. The vulnerability is due to improper validation of declared image size values during PDF image parsing, which allows an attacker to craft a malicious PDF that triggers excessive memory consumption and causes a denial-of-service condition...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +38 more potentially affected by CVE-2026-59935 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

nerxiv (>=0.0.1, <=1.1.0), osfexport (>=0.1.4, <=1.0.1) +3 more potentially affected by CVE-2026-59935 via pypdf (5.7.0)

pypdf PYPI version 5.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - nerxiv =0.0.1, =0.1.4, =0.0.1, =0.3.3, =30.0.8, =30.0.9 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-59935 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-59935 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-59935 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-59935 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

gpt3discord (>=11.7.3, <=12.3.8) potentially affected by CVE-2026-59935 via pypdf (3.11.1)

pypdf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gpt3discord =11.7.3, =12.3.8 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-59935 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

py40kie (>=0.1.0, <=0.2.2) potentially affected by CVE-2026-59935 via pypdf (3.12.2)

pypdf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - py40kie =0.1.0, =0.2.2 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-59935 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-59935 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

chellow (>=1679494175.0.0, <=1688376223.0.0), pretix (>=4.18.0, <=4.18.2.post1) potentially affected by CVE-2026-59935 via pypdf (3.6.0)

pypdf PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1679494175.0.0, =4.18.0, =4.18.2.post1 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-59935 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-59935 Source advisory:...

calibreweb (0.6.20) potentially affected by CVE-2026-59935 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-59935 Source advisory: OSV:GHSA-G867-7843-WF8Q...