A vulnerability in pypdf allows an attacker to craft a PDF with manipulated FlateDecode-compressed XFA streams that can exhaust system RAM when the xfa property is accessed. This issue is fixed in pypdf version 3.3.14_6.
CVE-2026-27026 is a vulnerability in psutils' pypdf component where malformed /FlateDecode streams in PDFs can cause long runtimes due to inefficient byte-by-byte decompression. This can be exploited by an attacker crafting a malicious PDF. The issue is fixed in pypdf version 3.3.14_5. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-27025 is a vulnerability in psutils' pypdf component where specially crafted PDFs with large /ToUnicode streams can cause long runtimes and high memory usage during parsing, such as text extraction. This can lead to resource exhaustion. The issue is fixed in pypdf version 3.3.14_5.
A vulnerability in psutils' pypdf component allows an attacker to craft a malicious PDF that causes an infinite loop when processing a TreeObject, such as during outline traversal. This can lead to denial of service by resource exhaustion. The issue affects versions from 3.0 up to but not including 3.3.14_5 and has been fixed in version 3.3.14_5.
CVE-2026-22690 is a vulnerability in psutils' pypdf library where crafted PDF files lacking the /Root object but having large /Size values can cause long runtimes in non-strict reading mode. This issue affects versions >=3.0 and <3.3.14_3 and has been fixed in version 3.3.14_3. Using strict mode reading is a viable workaround to avoid the issue.
CVE-2025-66019 is a high-severity vulnerability in psutils affecting pypdf's handling of LZWDecode streams. An attacker can craft a malicious PDF that causes excessive memory consumption—up to 1 GB per stream—during parsing. This vulnerability has been fixed in pypdf version 6.4.0 and psutils version 3.3.14_2. Users unable to upgrade immediately can mitigate the issue by limiting the maximum output length of LZWDecode streams in their code.
CVE-2025-62708 is a high-severity vulnerability in psutils affecting versions >=3.0 and <3.3.14_1. It allows an attacker to craft a malicious PDF that triggers excessive memory consumption by exploiting the LZWDecode filter during content stream parsing. This can lead to RAM exhaustion on the affected system. The issue has been fixed in version 3.3.14_1.
CVE-2025-62707 is a vulnerability in psutils' pypdf component where parsing a crafted PDF containing a DCTDecode inline image without an EOF marker can cause an infinite loop. This flaw can be exploited by an attacker to cause denial of service by resource exhaustion. The issue affects versions from 3.0 up to but not including 3.3.14_1. A fix is available in version 3.3.14_1, and a workaround is to apply the changes from the referenced pull request if upgrading is not immediately possible.
CVE-2025-55197 is a high-severity vulnerability in psutils affecting PyPDF's handling of FlateDecode streams. An attacker can craft a malicious PDF that exhausts system RAM simply by reading it if the PDF uses a series of FlateDecode filters on a cross-reference stream. This vulnerability affects versions >=3.0 and <3.3.11_1 of psutils and has been fixed in version 3.3.11_1.
CVE-2026-41313 is a vulnerability in pypdf that allows an attacker to craft a PDF with a large trailer /Size value, causing long runtimes when loaded in incremental mode. This can lead to denial of service due to resource exhaustion. The issue affects pypdf versions from 3.0 up to but not including 3.3.14_14. A fix is available in version 3.3.14_14.
CVE-2026-22691 is a vulnerability in psutils' pypdf library where malformed PDF files with invalid startxref entries can cause long runtimes during cross-reference table rebuilding in non-strict reading mode. This issue affects versions from 3.0 up to but not including 3.3.14_3. The vulnerability has been fixed in version 3.3.14_3. Users can mitigate the issue by enabling strict mode when reading or writing PDFs.
A vulnerability in pypdf allows crafted PDFs with specific cross-reference stream configurations to cause long runtimes during processing. This occurs when cross-reference streams use zero-only width values (/W [0 0 0]) combined with large /Size values. The issue has been fixed in pypdf version 6.12.0.
CVE-2026-40260 is a vulnerability in pypdf where manipulated XMP metadata entity declarations in a crafted PDF can cause excessive memory usage during parsing. This can lead to exhaustion of RAM resources. The issue has been fixed in pypdf version 6.10.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in psutils' pypdf library allows an attacker to craft a PDF file that triggers an infinite loop when loading circular /Prev entries in cross-reference streams. This issue requires the file to be read by the vulnerable software. The flaw has been fixed in version 3.3.14_5 of psutils.
A vulnerability in psutils' pypdf component allows an attacker to craft a PDF that triggers an infinite loop when processing outlines or bookmarks. This flaw can cause denial of service by making the application hang. The issue has been fixed in pypdf version 6.6.2. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
The fontTools varLib component in the pdfly product is vulnerable to arbitrary file write and XML injection via malicious .designspace files. This vulnerability allows attackers to write files to arbitrary filesystem locations using path traversal and inject malicious content through XML labelname elements. Exploitation can lead to remote code execution without elevated privileges and potential system compromise. The issue affects versions >=0.4.0 and <0.5.1_3 and has been fixed in version 0.5.1_3.
CVE-2026-59886 is a denial-of-service vulnerability in the pyasn1 library's handling of ASN.1 REAL values. The issue arises when converting decoded REAL values with very large exponents to Python floats, causing excessive CPU and memory consumption that can hang the process. This affects pyasn1 versions from 8.11.0 up to but not including 10.2.1. The vulnerability is triggered by operations such as printing, logging, or comparing decoded REAL objects from untrusted ASN.1 data. It does not occur during decoding alone. The issue is fixed in pyasn1 version 10.2.1.
A vulnerability in pyasn1's BER/CER/DER decoders and encoders causes quadratic time complexity when processing OBJECT IDENTIFIER and RELATIVE-OID values with many arcs. This can lead to denial of service by consuming excessive CPU resources when decoding or encoding crafted ASN.1 data. The issue affects pyasn1 versions from 8.11.0 up to but not including 10.2.1 and is fixed in version 10.2.1.
A denial of service vulnerability exists in the pyasn1 BER/CER/DER decoder used by parsedmarc, caused by unbounded long-form tag IDs. The decoder accumulates continuation octets without an upper limit, allowing crafted inputs to cause excessive CPU consumption. On Python 3.11 and later, this can also trigger unhandled ValueError exceptions during error message formatting, potentially bypassing error handling. The issue affects decoding of untrusted BER/CER/DER inputs and was fixed in version 10.2.1 by limiting tag ID length and improving error handling.
The pyasn1 library contains a denial of service vulnerability due to unbounded recursion when decoding ASN.1 data with deeply nested indefinite-length SEQUENCE or SET tags. An attacker can supply a crafted payload that causes the decoder to recurse until the Python interpreter crashes with a RecursionError or exhausts memory, crashing the host application. This affects services parsing untrusted ASN.1 data such as LDAP, SNMP, Kerberos, or X.509 parsers. The vulnerability is fixed in pyasn1 version 9.2.1_2.