bondai (>=0.1.0, <=0.3.0b2) potentially affected by CVE-2026-41168 via pypdf (3.15.1)

pypdf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - bondai =0.1.0, =0.3.0b2 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

pretix (>=4.17.0, <=4.17.1), providentia (2.4.0) potentially affected by CVE-2026-41168 via pypdf (3.4.1)

pypdf PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pretix =4.17.0, =4.17.1 - providentia 2.4.0 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

label-sorter (>=0.2.0, <=0.3.0), sereto (0.3.5) potentially affected by CVE-2026-41168 via pypdf (5.8.0)

pypdf PYPI version 5.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - label-sorter =0.2.0, =0.3.0 - sereto 0.3.5 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

render50 (9.2.2) potentially affected by CVE-2026-41168 via pypdf (3.15.3)

pypdf PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - render50 9.2.2 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

docat (1.0.0) potentially affected by CVE-2026-41168 via pypdf (4.0.0)

pypdf PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docat 1.0.0 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-41168 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

py40kie (>=0.1.0, <=0.2.2) potentially affected by CVE-2026-41168 via pypdf (3.12.2)

pypdf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - py40kie =0.1.0, =0.2.2 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

calibreweb (0.6.20) potentially affected by CVE-2026-41168 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-41168 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-41168 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

PT-2026-34562

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.10.1 Description A flaw in the pure-python PDF library allows an attacker to craft a PDF that results in long runtimes. This is achieved by using cross-reference streams with incorrect large /Size values or object...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-40260 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

XML Entity Expansion

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to XML Entity Expansion when parsing XMP metadata. An attacker can cause excessive memory consumption with excessive DOCTYPE entity...

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in pypdf==6.10.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3724...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +65 more potentially affected by CVE-2026-40260 via pypdf (>=6.0.0, <=6.9.2)

pypdf PYPI version =6.0.0, =0.0.0, =1.1.0, =1.0.0a3, =0.2.0, =3.1.0, =0.2.0, =0.2.0, =0.0.3, =0.4.1, =6.2.61, =1.0.20, =1.0.31 and more Source cves: CVE-2026-40260 Source advisory: SNYK:PYTHON-PYPDF-15989793...

calibreweb (0.6.20) potentially affected by CVE-2026-40260 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

GHSA-3CRG-W4F6-42MX pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in pypdf==6.10.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3724...

automateboringstuff3 (2024.10.1), calibreweb (0.6.24) +6 more potentially affected by CVE-2026-40260 via pypdf (5.0.1)

pypdf PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - automateboringstuff3 2024.10.1 - calibreweb 0.6.24 - forgy =0.1.0, =0.1.0rc1, =0.0.12, =0.0.16 Source cves: CVE-2026-40260 Source advisory:...

aiagents4pharma (>=1.15.0, <=1.44.0), pypdftotext (>=0.0.6, <=0.0.9) +3 more potentially affected by CVE-2026-40260 via pypdf (5.2.0)

pypdf PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiagents4pharma =1.15.0, =0.0.6, =1.0.1, =1.0.1, =1.0.5 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +38 more potentially affected by CVE-2026-40260 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...