calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-33123 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

render50 (9.2.2) potentially affected by CVE-2026-33123 via pypdf (3.15.3)

pypdf PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - render50 9.2.2 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

chellow (>=1692799408.0.0, <=1698672999.0.0), pspdfutils (>=3.1.2, <=3.2.0) potentially affected by CVE-2026-33123 via pypdf (3.15.2)

pypdf PYPI version 3.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1692799408.0.0, =3.1.2, =3.2.0 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

bondai (>=0.1.0, <=0.3.0b2) potentially affected by CVE-2026-33123 via pypdf (3.15.1)

pypdf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - bondai =0.1.0, =0.3.0b2 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +60 more potentially affected by CVE-2026-33123 via pypdf (>=6.0.0, <=6.8.0)

pypdf PYPI version =6.0.0, =0.0.0, =1.0.0a3, =0.2.0, =3.1.0, =0.2.0, =0.2.0, =0.0.3, =6.2.61, =1.0.20, =0.12.0, =0.12.2 - calibreweb 0.6.26 and more Source cves: CVE-2026-33123 Source advisory: GHSA-QPXP-75PX-XJCP...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +60 more potentially affected by CVE-2026-33123 via pypdf (>=6.0.0, <=6.8.0)

pypdf PYPI version =6.0.0, =0.0.0, =1.0.0a3, =0.2.0, =3.1.0, =0.2.0, =0.2.0, =0.0.3, =6.2.61, =1.0.20, =0.12.0, =0.12.2 - calibreweb 0.6.26 and more Source cves: CVE-2026-33123 Source advisory: SNYK:PYTHON-PYPDF-15683822...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +60 more potentially affected by CVE-2026-33123 via pypdf (>=6.0.0, <=6.8.0)

pypdf PYPI version =6.0.0, =0.0.0, =1.0.0a3, =0.2.0, =3.1.0, =0.2.0, =0.2.0, =0.0.3, =6.2.61, =1.0.20, =0.12.0, =0.12.2 - calibreweb 0.6.26 and more Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +245 more potentially affected by CVE-2026-33123 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.11.2, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1,...

label-sorter (>=0.2.0, <=0.3.0), sereto (0.3.5) potentially affected by CVE-2026-33123 via pypdf (5.8.0)

pypdf PYPI version 5.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - label-sorter =0.2.0, =0.3.0 - sereto 0.3.5 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

nerxiv (>=0.0.1, <=1.1.0), osfexport (>=0.1.4, <=1.0.1) +3 more potentially affected by CVE-2026-33123 via pypdf (5.7.0)

pypdf PYPI version 5.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - nerxiv =0.0.1, =0.1.4, =0.0.1, =0.3.3, =30.0.8, =30.0.9 Source cves: CVE-2026-33123 Source advisory: OSV:GHSA-QPXP-75PX-XJCP...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service. The vulnerability is due to parsing a PDF content stream with an inflated Length value, where the parser allocates memory based on the declared length without verifying the actual data size, and an attacker can craft a PDF with a large /Length field to...

OPENSUSE-SU-2026:10334-1 python311-pypdf-6.8.0-1.1 on GA media

These are all security issues fixed in the python311-pypdf-6.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-31826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory...

SUSE CVE-2026-31826

pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. Thi...

agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-31826 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-31826 Source advisory: OSV:GHSA-HQMH-PPP3-XVM7...

ai-enterprise-agent (>=0.0.4, <=0.0.9), almax-common (>=1.0.5.dev20240601224039, <=1.0.7.dev20240801212517) +25 more potentially affected by CVE-2026-31826 via pypdf (4.2.0)

pypdf PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - ai-enterprise-agent =0.0.4, =1.0.5.dev20240601224039, =2024.7.4, =0.6.22, =0.2.1, =0.2.0, =0.0.5, =0.2.1, =3.3.2, =0.1.0, =0.0.1, =4.7.1, =0.1.0, =0.1...

indico (>=3.2.6, <=3.2.9) potentially affected by CVE-2026-31826 via pypdf (3.12.1)

pypdf PYPI version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - indico =3.2.6, =3.2.9 Source cves: CVE-2026-31826 Source advisory: OSV:GHSA-HQMH-PPP3-XVM7...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in readfromstream, when parsing PDF content streams. An attacker can consume...

pypdf: manipulated stream length values can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. Patches This has been fixed in pypdf==6.8.0. Workarounds If you canno...

py40kie (>=0.1.0, <=0.2.2) potentially affected by CVE-2026-31826 via pypdf (3.12.2)

pypdf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - py40kie =0.1.0, =0.2.2 Source cves: CVE-2026-31826 Source advisory: OSV:GHSA-HQMH-PPP3-XVM7...