CVE-2026-102993

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of...

CVE-2026-102997

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that...

CVE-2026-24688

CVE-2026-24688 - pypdf - Vulnerabilidad DoS por Referencia Circular Este repositorio incluye código de prueba de concepto para desencadenar CVE-2026-24688. Resumen Vulnerabilidad crítica de Denegación de Servicio en la lógica de análisis de esquemas marcadores de pypdf. Al procesar un PDF con...

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed /FlateDecode stream, where the byte-by-byte decompression is used. PatchesThis has been fixed in pypdf==6.18.1. WorkaroundsIf you cannot upgrade yet, consider applying t...

pypdf: Possible long runtimes with large amount of embedded files

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 4081...

pypdf: Possible large memory usage when retrieving alphabetical page labels

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider applying the...

pypdf: Possible long runtimes when generating appearance streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider...

PYSEC-2026-4159 pypdf: Possible long runtimes with large amount of embedded files

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4081...

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. PatchesThis has been fixed in pypdf==6.18.0. WorkaroundsIf you cannot upgrade yet, consider applying th...

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. PatchesThis has been fixed in pypdf==6.18.1. WorkaroundsIf you cannot upgrad...

pypdf: Possible large memory usage when retrieving Roman page labels

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals. PatchesThis has been fixed in pypdf==6.17.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes...

pypdf: Possible large memory usage when parsing font data

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. PatchesThis has been fixed in pypdf==6.18.1. WorkaroundsIf y...

PYSEC-2026-4153 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

pypdf: Possible long runtimes with large amount of embedded files

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4081...

EUVD-2026-90272

pypdf: Possible long runtimes with large amount of embedded files...

EUVD-2026-90384

pypdf: Possible long runtimes when generating appearance streams...

pypdf: Possible long runtimes when generating appearance streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider...

pypdf: Possible large memory usage when retrieving alphabetical page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the...

EUVD-2026-90283

pypdf: Possible large memory usage when retrieving alphabetical page labels...

GHSA-JW7Q-GVRG-4VJ3 pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed /FlateDecode stream, where the byte-by-byte decompression is used. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot upgrade yet, consider applyin...