CVE-2026-27026 pypdf possibly has long runtimes for malformed FlateDecode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +610 more potentially affected by CVE-2026-27026 via pypdf (>=3.1.0, <=6.7.0)

pypdf PYPI version =3.1.0, =0.1.1, =0.9.1, =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.0.1, =0.0.4, =0.0.9 and more Source cves: CVE-2026-27026 Source advisory: MEND:CVE-2026-27026...

CVE-2026-27026

CVE-2026-27026 affects the Python PDF library pypdf (formerly PyPDF2) and concerns a malformed /FlateDecode stream that can trigger byte-by-byte decompression leading to excessively long processing times. Multiple connected advisories confirm the issue and note a fix released in version 6.7.1 (pe...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +610 more potentially affected by CVE-2026-27025 via pypdf (>=3.1.0, <=6.7.0)

pypdf PYPI version =3.1.0, =0.1.1, =0.9.1, =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.0.1, =0.0.4, =0.0.9 and more Source cves: CVE-2026-27025 Source advisory: MEND:CVE-2026-27025...

CVE-2026-27025

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text...

CVE-2026-27025 pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text...

CVE-2026-27025 pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text...

CVE-2026-27025 pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text...

CVE-2026-27025

CVE-2026-27025 affects the PyPDF family (pypdf). The issue is triggered by parsing a PDF’s font /ToUnicode entry with unusually large values, causing long runtimes and large memory usage (DoS risk). The vulnerability is fixed in pypdf 6.7.1; remediation is upgrading to 6.7.1 or newer. Connected a...

CVE-2026-27024

CVE-2026-27024 affects the pypdf (pypdf2) library prior to 6.7.1. The vulnerability allows an attacker to craft a PDF that causes an infinite loop when processing TreeObject children (e.g., in outlines), resulting in a DoS. The issue is fixed in version 6.7.1; multiple connected advisories (openS...

CVE-2026-27024

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

CVE-2026-27024 pypdf has a possible infinite loop when processing TreeObject

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

CVE-2026-27024

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

CVE-2026-27024 pypdf has a possible infinite loop when processing TreeObject

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +610 more potentially affected by CVE-2026-27024 via pypdf (>=3.1.0, <=6.7.0)

pypdf PYPI version =3.1.0, =0.1.1, =0.9.1, =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.0.1, =0.0.4, =0.0.9 and more Source cves: CVE-2026-27024 Source advisory: MEND:CVE-2026-27024...

CVE-2026-27024 pypdf has a possible infinite loop when processing TreeObject

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

CVE-2026-27026: Allocation of Resources Without Limits or Throttling

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1...

pypdf security vulnerability

pypdf is an open-source, free Python library developed by py-pdf. It allows for splitting, merging, cropping, and converting pages within PDF files. Versions of pypdf prior to 6.7.1 contained security vulnerabilities. These vulnerabilities stemmed from /ToUnicode entries in the font parsing, whic...

pypdf security vulnerability

pypdf is an open-source, free Python library for handling PDF files. It allows for splitting, merging, cropping, and converting pages within PDF files. Versions of pypdf prior to 6.7.1 contained security vulnerabilities; these vulnerabilities stemmed from accessing child items of the TreeObject...

CVE-2026-27024: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...