calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-24688 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-24688 Source...

pdfmerge (1.0.0), ribometric (>=0.1.4, <=0.1.12) potentially affected by CVE-2026-24688 via pypdf (3.9.0)

pypdf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pdfmerge 1.0.0 - ribometric =0.1.4, =0.1.12 Source cves: CVE-2026-24688 Source advisory: OSV:GHSA-2Q4J-M29V-HQ73...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +37 more potentially affected by CVE-2026-24688 via pypdf (>=6.0.0, <=6.6.0)

pypdf PYPI version =6.0.0, =0.0.0, =6.2.61, =2.4.23, =1.4.0, =1759155233.0.0, =1.14.0, =0.34.0, =1.5.0, =1.12.1 - genai-4-dps-helper 0.2.32 and more Source cves: CVE-2026-24688 Source advisory: GHSA-2Q4J-M29V-HQ73...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via the getoutline function. An attacker can cause the application to enter an infinite loop by crafting PDF file wi...

GHSA-2Q4J-M29V-HQ73 pypdf has possible Infinite Loop when processing outlines/bookmarks

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. Patches This has been fixed in pypdf 6.6.2. Workarounds If projects cannot upgrade yet, consider applying the changes from PR 3610...

pypdf has possible Infinite Loop when processing outlines/bookmarks

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. Patches This has been fixed in pypdf 6.6.2. Workarounds If projects cannot upgrade yet, consider applying the changes from PR 3610...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +37 more potentially affected by CVE-2026-24688 via pypdf (>=6.0.0, <=6.6.0)

pypdf PYPI version =6.0.0, =0.0.0, =6.2.61, =2.4.23, =1.4.0, =1759155233.0.0, =1.14.0, =0.34.0, =1.5.0, =1.12.1 - genai-4-dps-helper 0.2.32 and more Source cves: CVE-2026-24688 Source advisory: OSV:GHSA-2Q4J-M29V-HQ73...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +245 more potentially affected by CVE-2026-24688 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.11.2, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1,...

Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data are addressed

Summary There are multiple vulnerabilities impacting IBM Watson Studio in Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-7647 DESCRIPTION: The llama-index-core package, up to version 0.12.44, contains a...

Denial-of-service (DoS)

pypdf is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of PDFs missing the /Root object with a large /Size value in non-strict parsing mode, which allows an attacker to craft an invalid PDF that triggers excessively long runtimes...

CVE-2026-22691

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file with malformed startxref entries and excessive whitespace characters. This can cause excessively long processing times when rebuilding the cross-reference table in non-strict reading mode,...

CVE-2026-22690

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be...

SUSE CVE-2026-22690

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be...

SUSE CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-referen...

OPENSUSE-SU-2026:10044-1 python311-pypdf-6.6.0-1.1 on GA media

These are all security issues fixed in the python311-pypdf-6.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-referen...

CVE-2026-22690

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be...

UBUNTU-CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-referen...

CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-referen...

CVE-2026-22690

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be...