CVE-2026-115585

The pypdf pure-python PDF library is vulnerable to long runtimes when processing crafted PDF files containing repeated malformed cross-reference entries . In versions prior to 6.21.2 , an incomplete remediation allowed these entries to trigger a complete PDF stream reload during each recovery att...

CVE-2026-115580

The pypdf pure-python PDF library is vulnerable to a denial-of-service condition prior to version 6.21.2 . An attacker can craft a PDF file with a standard cross-reference (xref) table where the declared entry count exceeds the actual contents of the file. This discrepancy triggers excessive proc...

CVE-2026-115572

The pypdf pure-python PDF library (versions prior to 6.21.2 ) is vulnerable to uncontrolled resource consumption. An attacker can craft a malicious PDF that repeatedly references the same nonexistent indirect object . This forces the library to perform repeated full-file recovery loads whenever p...

CVE-2026-113786

pypdf is a free and open-source pure-python PDF library. Prior to 6.21...

CVE-2026-113789

pypdf is a free and open-source pure-python PDF library. Prior to 6.21...

pypdf: Possible long runtimes/large memory usage when retrieving form fields

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR...

EUVD-2026-107327

pypdf: Possible long runtimes/large memory usage when retrieving form fields...

GHSA-6VVC-X485-93V7 pypdf: Possible long runtimes/large memory usage when retrieving form fields

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR...

pypdf: Possible large memory usage when parsing arrays and dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

EUVD-2026-107330

pypdf: Possible large memory usage when parsing arrays and dictionaries...

GHSA-F54X-CMQ8-QG57 pypdf: Possible large memory usage when parsing arrays and dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

pypdf: Possible large memory usage when parsing content streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

EUVD-2026-107331

pypdf: Possible large memory usage when parsing content streams...

GHSA-CGF9-327M-V77C pypdf: Possible large memory usage when parsing content streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

SUSE CVE-2026-113786

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow...

SUSE CVE-2026-113789

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

GHSA-5HX5-VPF9-5WCV pypdf: Unvalidated JPEG image data loading

Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter JPEG data. Users which do not have the optional Pillow dependency installed in their environment are not...

pypdf: Unvalidated JPEG image data loading

Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter JPEG data. Users which do not have the optional Pillow dependency installed in their environment are not...

CVE-2026-113786

A flaw was found in pypdf. A remote attacker could trigger a Denial of Service DoS or unexpected behavior by enticing a user or service to process a specially crafted PDF document. When an image marked with a JPEG filter is loaded, pypdf fails to restrict decoding to the JPEG format before passin...