CVE-2026-113790 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing large memory usage during parsing of arrays and dictionaries with many elements. This can lead to resource exhaustion on the system processing the PDF. The issue has been fixed in pypdf version 6.21.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-113789 is a vulnerability in pypdf that allows an attacker to craft a PDF causing excessive memory usage and long runtimes when retrieving form fields. This can degrade performance or cause denial of service. The issue is fixed in pypdf version 6.21.0.
CVE-2026-114603 is a vulnerability in the OpenTelemetry Python package opentelemetry-api affecting the TraceState.from_header method. The vulnerability arises from an unbounded regular expression that parses the W3C tracestate header, leading to quadratic CPU time complexity when processing long runs of spaces or tabs without commas. This can cause denial-of-service by blocking the handling worker for several seconds on a single unauthenticated request with a large tracestate header. The issue affects versions from 1.0.0 through at least v1.45.0 and is fixed in version 4.5.1_15. The vulnerability does not impact confidentiality or integrity but causes availability degradation due to CPU exhaustion.
CVE-2026-113795 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing large memory consumption when processing streams with multiple or large filters. This can lead to resource exhaustion on the system handling the PDF. The issue affects pypdf versions from 3.0 up to but not including 3.3.17_2. A fix is available in version 3.3.17_2. If upgrading is not immediately possible, applying the changes from the referenced pull request is recommended as a workaround.
CVE-2026-113793 is a vulnerability in pypdf that allows an attacker to craft a PDF causing an infinite loop when removing an object from a tree structure, such as an outline item. This can lead to denial of service conditions. The issue has been fixed in pypdf version 6.20.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf's PdfWriter.find_outline_item function can cause an infinite loop when processing a crafted PDF. This flaw allows an attacker to create a PDF that triggers this behavior. The issue has been fixed in pypdf version 6.20.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf allows crafted PDFs with JPEG images using the /DCTDecode filter to trigger arbitrary image parsers. This affects users who have the optional Pillow dependency installed. The issue is fixed in pypdf version 3.3.17_2.
CVE-2026-113794 is a vulnerability in pypdf that allows an attacker to craft a malformed PDF file which causes an infinite loop when the file ends inside the standard xref table. This issue has been fixed in pypdf version 6.20.0. Until upgrading, applying the changes from the referenced pull request is recommended as a workaround.
This is a security update for the pki-core component in SUSE products, providing a functional equivalent of a Red Hat advisory RHSA-2026:86623. The update addresses a vulnerability identified as CVE-2026-76561. No specific affected versions or technical details are provided in the input data.
Red Hat has issued a security update for python3.9 addressing multiple vulnerabilities involving quadratic complexity and CPU denial of service in Python's HTML parser and os.path.expandvars() function. These issues could lead to performance degradation or denial of service conditions when processing specially crafted inputs. The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 9.2 and related variants. Users are advised to apply the provided update packages to remediate these vulnerabilities.
A reference leak vulnerability exists in the items-view union and subtraction operators of aio-libs/multidict versions 6.7.0 through 6.9.0. This flaw allows a remote client to cause unbounded memory growth by leaking references to key-identity and value objects during certain set operations on items views. The leak occurs because the code fails to release new references created during parsing, leading to unreclaimable memory consumption until the process is terminated.
CVE-2026-103000 is a high-severity vulnerability in pypdf that allows an attacker to craft a PDF causing large memory consumption when retrieving alphabetical page labels. This issue affects versions from 3.0 up to but not including 3.3.17_1. The vulnerability has been fixed in pypdf version 3.3.17_1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-102999 is a vulnerability in pypdf that allows an attacker to craft a PDF with a large number of embedded files, causing long runtimes when accessed via the dictionary-based API. This can lead to denial of service due to resource exhaustion. The issue is fixed in pypdf version 6.19.0.
CVE-2026-102998 is a vulnerability in pypdf that allows an attacker to craft a PDF causing long runtimes during appearance stream generation when updating form field values with flattening enabled. This issue has been fixed in pypdf version 6.19.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-102997 is a vulnerability in pypdf affecting versions >=3.0 and <3.3.17_1. It allows an attacker to craft a PDF with a partially malformed /FlateDecode stream that causes long runtimes during byte-by-byte decompression. This can lead to denial of service due to resource exhaustion. The issue is fixed in pypdf version 3.3.17_1.
CVE-2026-102996 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing excessive memory consumption during parsing of font data, specifically the /Widths entry of TrueType or Type1 fonts with unusually large values. This can occur during operations like text extraction. The issue has been fixed in pypdf version 3.3.17_1.
A vulnerability in pypdf allows an attacker to craft a PDF with a large /ToUnicode stream in a font, causing excessive memory consumption during parsing, such as text extraction. This issue has been fixed in pypdf version 6.18.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.