pypdf has possible long runtimes for malformed startxref

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Patches...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2545 more potentially affected by CVE-2026-22691 via pypdf (>=3.10.0 <=6.5.0)

pypdf PYPI version =3.10.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =3.0.145 and more Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

GHSA-4F6G-68PF-7VHV pypdf has possible long runtimes for malformed startxref

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Patches...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2545 more potentially affected by CVE-2026-22690 via pypdf (>=3.10.0 <=6.5.0)

pypdf PYPI version =3.10.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =3.0.145 and more Source cves: CVE-2026-22690 Source advisory: OSV:GHSA-4XC4-762W-M6CG...

Unchecked Input for Loop Condition

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Unchecked Input for Loop Condition in the processing of PDF files when the /Root entry is omitted from the trailer and a large /Si...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2084 more potentially affected by CVE-2026-22690 via pypdf (>=6.0.0 <=6.5.0)

pypdf PYPI version =6.0.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =0.1.0, =0.6.0, =0.7.3 and more Source cves: CVE-2026-22690 Source advisory: SNYK:PYTHON-PYPDF-14912440...

pypdf has possible long runtimes for missing /Root object with large /Size values

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. Patches This...

GHSA-4XC4-762W-M6CG pypdf has possible long runtimes for missing /Root object with large /Size values

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. Patches This...

PT-2026-2244

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.6.0 Description pypdf is a free and open-source pure-python PDF library. Versions prior to 6.6.0 are susceptible to potential long runtimes when processing PDF files missing the /Root object but containing a large /Si...

PT-2026-4845

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.6.2 Description A flaw exists in the pypdf library that allows attackers to trigger an infinite loop by creating a PDF file with cyclic outline references. This requires accessing the outlines or bookmarks within the...

Denial-of-service (DoS)

pypdf is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of inline images using the DCTDecode filter during PDF content stream parsing, which allows an attacker to craft a malicious PDF that triggers an infinite loop and causes CPU exhaustion...

Denial-of-service (DoS)

pypdf is vulnerable to Denial-of-service DoS. The vulnerability is due to improper handling of the LZWDecode filter while parsing a PDF page content stream, which allows an attacker to craft a malicious PDF that triggers excessive memory usage...

Uncontrolled Memory Allocation

pypdf is vulnerable to uncontrolled memory allocation. The vulnerability is due to improper handling of LZWDecode streams, which allows an attacker to craft a malicious PDF that causes excessive memory consumption up to 1 GB per stream during content parsing...

Linux Distros Unpatched Vulnerability : CVE-2025-66019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory...

SUSE CVE-2025-66019

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patch...

CVE-2025-66019

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patch...

pypdf 安全漏洞

pypdf is py-pdf open source a free open source pure python PDF library . It is able to split, merge, crop and convert pages of a PDF file. pypdf versions prior to 6.4.0 has a security vulnerability , the vulnerability stems from the LZWDecode filter parsing PDF content streams may lead to excessi...

CVE-2025-66019 pypdf manipulated LZWDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patch...

CVE-2025-66019

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patch...

CVE-2025-66019

CVE-2025-66019 affects the Python PDF library pypdf up to version 6.3.x. Reporter data from multiple sources state that parsing a page content stream using the LZWDecode filter can cause memory usage to balloon to as much as 1 GB per stream, leading to potential denial of service on affected pars...