CVE-2026-27026: Allocation of Resources Without Limits or Throttling

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1...

CVE-2026-27024: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the FlateDecode class. An attacker can cause excessive resource consumptio...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-27026 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-27026...

pdfmerge (1.0.0), ribometric (>=0.1.4, <=0.1.12) potentially affected by CVE-2026-27026 via pypdf (3.9.0)

pypdf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pdfmerge 1.0.0 - ribometric =0.1.4, =0.1.12 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +50 more potentially affected by CVE-2026-27026 via pypdf (>=6.0.0, <=6.7.0)

pypdf PYPI version =6.0.0, =0.0.0, =0.2.0, =0.2.0, =6.2.61, =1.0.20, =0.12.0, =2.4.23, =1.4.0, =1.4.1 and more Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

docat (1.0.0) potentially affected by CVE-2026-27026 via pypdf (4.0.0)

pypdf PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docat 1.0.0 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-27026 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-27026 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-27026 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-27026 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-27026 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-27026 Source...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-27026 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

gpt3discord (>=11.7.3, <=12.3.8) potentially affected by CVE-2026-27026 via pypdf (3.11.1)

pypdf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gpt3discord =11.7.3, =12.3.8 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2026-27026 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

pypdf possibly has long runtimes for malformed FlateDecode streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. Patches This has been fixed in pypdf==6.7.1. Workarounds If you cannot upgrade yet, consider applying the chang...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +50 more potentially affected by CVE-2026-27026 via pypdf (>=6.0.0, <=6.7.0)

pypdf PYPI version =6.0.0, =0.0.0, =0.2.0, =0.2.0, =6.2.61, =1.0.20, =0.12.0, =2.4.23, =1.4.0, =1.4.1 and more Source cves: CVE-2026-27026 Source advisory: GHSA-9MVC-8737-8J8H...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +50 more potentially affected by CVE-2026-27026 via pypdf (>=6.0.0, <=6.7.0)

pypdf PYPI version =6.0.0, =0.0.0, =0.2.0, =0.2.0, =6.2.61, =1.0.20, =0.12.0, =2.4.23, =1.4.0, =1.4.1 and more Source cves: CVE-2026-27026 Source advisory: SNYK:PYTHON-PYPDF-15309551...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +245 more potentially affected by CVE-2026-27026 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.11.2, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1,...

nerxiv (>=0.0.1, <=1.1.0), osfexport (>=0.1.4, <=1.0.1) +3 more potentially affected by CVE-2026-27026 via pypdf (5.7.0)

pypdf PYPI version 5.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - nerxiv =0.0.1, =0.1.4, =0.0.1, =0.3.3, =30.0.8, =30.0.9 Source cves: CVE-2026-27026 Source advisory: OSV:GHSA-9MVC-8737-8J8H...