agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-41168 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

criscostack (1.0.0), neumai (>=0.0.9, <=0.0.36) +2 more potentially affected by CVE-2026-41168 via pypdf (3.9.1)

pypdf PYPI version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - criscostack 1.0.0 - neumai =0.0.9, =0.0.17, =2023.6.0, =2024.4.0 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

cocpyth (>=0.1.1, <=0.1.2), pretix (>=4.19.0, <=4.20.4) potentially affected by CVE-2026-41168 via pypdf (3.8.1)

pypdf PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cocpyth =0.1.1, =4.19.0, =4.20.4 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-41168 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-41168 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-41168 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-41168 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

pspdfutils (>=3.0.5, <=3.0.7) potentially affected by CVE-2026-41168 via pypdf (3.10.0)

pypdf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pspdfutils =3.0.5, =3.0.7 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

calibreweb (0.6.20) potentially affected by CVE-2026-41168 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-41168 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

athena-starship (>=0.0.3, <=0.0.6), conflare (>=0.1.2, <=0.1.3) +11 more potentially affected by CVE-2026-41168 via pypdf (4.1.0)

pypdf PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - athena-starship =0.0.3, =0.1.2, =2.2.0, =3.3.0, =1.14.0, =0.1.4, =4.6.2, =0.1.0, =0.1.7 Source cves: CVE-2026-41168 Source advisory:...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +137 more potentially affected by CVE-2026-41168 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-41168 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

indico (>=3.2.6, <=3.2.9) potentially affected by CVE-2026-41168 via pypdf (3.12.1)

pypdf PYPI version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - indico =3.2.6, =3.2.9 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-41168 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

Improper Validation of Specified Quantity in Input

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input through the PdfReader object stream and xref stream parsers in pypdf/reader.py...

label-sorter (>=0.2.0, <=0.3.0), sereto (0.3.5) potentially affected by CVE-2026-41168 via pypdf (5.8.0)

pypdf PYPI version 5.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - label-sorter =0.2.0, =0.3.0 - sereto 0.3.5 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

GHSA-JJ6C-8H6C-HPPX pypdf has long runtimes for wrong size values in cross-reference and object streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. Patches This has been fixed in pypdf==6.10.1. Workarounds If you cannot upgrade yet,...

pdfmerge (1.0.0), ribometric (>=0.1.4, <=0.1.12) potentially affected by CVE-2026-41168 via pypdf (3.9.0)

pypdf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pdfmerge 1.0.0 - ribometric =0.1.4, =0.1.12 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

docat (1.0.0) potentially affected by CVE-2026-41168 via pypdf (4.0.0)

pypdf PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docat 1.0.0 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...