A vulnerability in pypdf allows an attacker to craft a PDF with image dimensions that are much larger than the actual image data, causing excessive memory usage when the PDF is processed. This issue has been fixed in pypdf version 6.14.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-59937 is a vulnerability in pypdf that allows an attacker to craft a PDF with repeated malformed cross-reference streams, causing long runtimes during processing. This issue has been fixed in pypdf version 6.14.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-59936 is a high-severity vulnerability in pypdf that allows an attacker to craft a PDF containing a not terminated inline image, causing an infinite loop during content stream parsing such as text extraction. This flaw has been fixed in pypdf version 6.14.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-59935 is a high-severity vulnerability in pypdf that allows an attacker to craft a PDF containing a not terminated inline image using ASCII85 or ASCIIHex filters, causing an infinite loop during content stream parsing such as text extraction. This issue affects pypdf versions from 3.0 up to but not including 3.3.15_3. A fix is available in version 3.3.15_3.
CVE-2026-57204 is a vulnerability in pypdf where missing stream length values cause the parser to ignore defined limits, potentially leading to excessive memory usage. This occurs when parsing a PDF content stream without a /Length value. The issue has been fixed in pypdf version 6.13.3.
A vulnerability in pypdf allows an attacker to craft a PDF that causes an infinite loop when merging files containing threads or articles. This issue has been fixed in pypdf version 6.13.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-54531 is a vulnerability in pypdf that can cause an infinite loop when processing PDF outlines/bookmarks during merging operations. This occurs when a crafted PDF with outlines is merged into a writer. The issue has been fixed in pypdf version 6.13.0.
CVE-2026-54530 is a vulnerability in pypdf that can cause an infinite loop when extracting text in layout mode from a crafted PDF. This flaw allows an attacker to create a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.13.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-49461 is a vulnerability in pypdf that allows an attacker to craft a PDF causing large memory usage during text extraction. This occurs when a page contains a form XObject with self-references. The issue has been fixed in pypdf version 6.12.2. Users unable to upgrade can apply the changes from pull request #3805 as a workaround.
CVE-2026-49460 is a vulnerability in pypdf affecting the decoding of FlateDecode streams with PNG predictors. An attacker can craft a PDF that causes inefficient decoding, leading to long runtimes when processing such streams. This issue has been fixed in pypdf version 6.12.2. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-48735 is a vulnerability in pypdf where manipulated XMP metadata streams in crafted PDF files can cause excessive memory consumption during parsing. This can lead to large RAM usage due to processing of unnecessarily large or complex metadata elements. The issue has been fixed in pypdf version 6.12.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-48155 is a vulnerability in pypdf that allows an attacker to craft a PDF causing large memory usage when extracting text in layout mode with large character offsets. This issue has been fixed in pypdf version 6.12.0. Until upgrading, developers can apply the changes from pull request #3790 as a workaround.
CVE-2026-41314 is a vulnerability in pypdf where manipulated image dimensions in FlateDecode streams can cause excessive RAM consumption. An attacker can craft a malicious PDF with large size values in a FlateDecode image, leading to resource exhaustion. This issue has been fixed in pypdf version 3.3.14_14. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-41312 is a vulnerability in pypdf where specially crafted PDF files with manipulated FlateDecode predictor parameters can cause RAM exhaustion. This occurs when a stream compressed with /FlateDecode uses a /Predictor value other than 1 with large predictor parameters. The issue has been fixed in pypdf version 6.10.2.
CVE-2026-41168 is a medium severity vulnerability in psutils' pypdf component where specially crafted PDFs with incorrect large size values in cross-reference or object streams cause long runtimes. This can lead to denial of service due to resource exhaustion. The issue is fixed in pypdf version 3.3.14_13.
A vulnerability in pypdf allows an attacker to craft a malicious PDF that causes an infinite loop during recovery attempts in the DictionaryObject.read_from_stream function when reading files in non-strict mode. This issue has been fixed in pypdf version 6.9.2.
CVE-2026-33123 is a vulnerability in psutils' pypdf component where inefficient decoding of array-based streams can cause long runtimes and increased memory usage when processing crafted PDFs. This issue affects versions from 3.0 up to but not including 3.3.14_10. The vulnerability has been fixed in version 3.3.14_10. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-31826 is a vulnerability in pypdf where manipulated stream length values in a crafted PDF can cause excessive memory usage during parsing. This occurs when the /Length value in a content stream is set large, regardless of the actual stream data size. The issue has been fixed in pypdf version 6.8.0. Workarounds include applying changes from a specific pull request if upgrading is not immediately possible. The vulnerability mainly affects reading from buffers of unknown size, such as raw file reads, but not when passing file paths or BytesIO buffers.
CVE-2026-28804 is a vulnerability in psutils' pypdf component where inefficient decoding of ASCIIHexDecode streams can cause long runtimes. An attacker can craft a malicious PDF that triggers this inefficiency. The issue is fixed in pypdf version 3.3.14_8. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-28351 is a vulnerability in pypdf where specially crafted PDFs with manipulated RunLengthDecode streams can cause excessive memory consumption during parsing. This can lead to exhaustion of system RAM. The issue affects pypdf versions from 3.0 up to but not including 3.3.14_7. A fix is available in version 3.3.14_7. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.