pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-22691 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

render50 (9.2.2) potentially affected by CVE-2026-22691 via pypdf (3.15.3)

pypdf PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - render50 9.2.2 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

chellow (>=1692799408.0.0, <=1698672999.0.0), pspdfutils (>=3.1.2, <=3.2.0) potentially affected by CVE-2026-22691 via pypdf (3.15.2)

pypdf PYPI version 3.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1692799408.0.0, =3.1.2, =3.2.0 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-22691 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-22691 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-22691 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-22691 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

bondai (>=0.1.0, <=0.3.0b2) potentially affected by CVE-2026-22691 via pypdf (3.15.1)

pypdf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - bondai =0.1.0, =0.3.0b2 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

iiiflow (>=0.1.0, <=1.3.2), mayan-edms (>=4.5.0, <=4.5.8) potentially affected by CVE-2026-22691 via pypdf (3.14.0)

pypdf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - iiiflow =0.1.0, =4.5.0, =4.5.8 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

py40kie (>=0.1.0, <=0.2.2) potentially affected by CVE-2026-22691 via pypdf (3.12.2)

pypdf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - py40kie =0.1.0, =0.2.2 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

indico (>=3.2.6, <=3.2.9) potentially affected by CVE-2026-22691 via pypdf (3.12.1)

pypdf PYPI version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - indico =3.2.6, =3.2.9 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +9 more potentially affected by CVE-2026-22691 via pypdf (3.17.1)

pypdf PYPI version 3.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - a-data-processing 0.0.1 - ab-data-processing 0.0.1 - arac 0.0.1 - crate-anon 0.20.7 - generalagent =0.0.6, =0.0.1, =0.1.0, =0.0.1, =0.0.14 - pyxreade...

agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-22691 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-22691 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-22691...

nerxiv (>=0.0.1, <=1.1.0), osfexport (>=0.1.4, <=1.0.1) +3 more potentially affected by CVE-2026-22691 via pypdf (5.7.0)

pypdf PYPI version 5.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - nerxiv =0.0.1, =0.1.4, =0.0.1, =0.3.3, =30.0.8, =30.0.9 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

pypdf has possible long runtimes for malformed startxref

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Patches...

Regular Expression Denial of Service (ReDoS)

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the flatten function. An attacker can cause excessive processing times by providing ...

docat (1.0.0) potentially affected by CVE-2026-22691 via pypdf (4.0.0)

pypdf PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docat 1.0.0 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-22690 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-22690 Source advisory: OSV:GHSA-4XC4-762W-M6CG...

pretix (>=4.17.0, <=4.17.1), providentia (2.4.0) potentially affected by CVE-2026-22690 via pypdf (3.4.1)

pypdf PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pretix =4.17.0, =4.17.1 - providentia 2.4.0 Source cves: CVE-2026-22690 Source advisory: OSV:GHSA-4XC4-762W-M6CG...