pypdf: Possible large memory usage when retrieving alphabetical page labels

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider applying the...

PYSEC-2026-4160 pypdf: Possible large memory usage when retrieving alphabetical page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the...

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. PatchesThis has been fixed in pypdf==6.18.1. WorkaroundsIf you cannot upgrad...

PYSEC-2026-4155 pypdf: Possible large memory usage when parsing font data

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds I...

PYSEC-2026-4153 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

GHSA-W23X-9JRW-R45C pypdf: Possible large memory usage when retrieving alphabetical page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the...

GHSA-G9CG-PRRW-2R8Q pypdf: Possible large memory usage when parsing font data

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds I...

pypdf: Possible large memory usage when parsing font data

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds I...

GHSA-FP3H-C4FM-7VVF pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot...

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot...

GHSA-5JQ2-8X83-X246 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

pypdf: Possible large memory usage when retrieving Roman page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals. Patches This has been fixed in pypdf==6.17.0. Workarounds If you cannot upgrade yet, consider applying the chang...

CVE-2026-102996 pypdf: Possible large memory usage when parsing font data

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/font.py Font.collectttt1characterwidths to process entries beyond the 256 character codes meaningful for a simpl...

CVE-2026-102994 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

CVE-2026-64415

In the Linux kernel, the following vulnerability has been resolved: mm/swap: add condresched in swapreclaimfullclusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about 1TB...

netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory up to 32 MB per block before...

pypdf: Manipulated XMP metadata streams can exhaust RAM

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. PatchesThis has been fixed in pypdf==6.12.1. WorkaroundsIf you cannot upgrade yet, consider applying the changes...

CVE-2026-55213

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling...

PT-2026-52229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/umem component where the linearization of mapping when using an iommu can result in a single large block split across multiple SG entries. The function rdma...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksm: The range-walk function is used to skip over unmapped regions during the scangetnextrmapitem operation. Currently, scangetnextrmapitem traverses every page address in a VMA to locate mergeable pages. This approach becomes...