Threats affecting pkg:pypi/pypdf

CVE-2026-102998 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by inefficient processing of appearance-stream generation when updating PDF form fields with flattening enabled. This can lead to excessive runtimes and potential application unavailability. The issue is fixed in pypdf version 6.19.0.

pypdf versions prior to 6.18.1 contain a vulnerability where a crafted PDF with a malformed /FlateDecode stream causes inefficient byte-by-byte decompression. This leads to excessive resource consumption, resulting in long runtimes and potential application unavailability. The issue is a residual problem after a previous fix related to malformed FlateDecode recovery. The vulnerability is fixed in version 6.18.1.

CVE-2026-102996 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by processing an unusually large /Widths array in a crafted PDF's simple font. This leads to excessive memory usage during operations like text extraction. The issue is fixed in pypdf version 6.18.1.

CVE-2026-102995 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by crafted PDFs that place unusually large tokens in a font /ToUnicode mapping. This triggers excessive memory use during text extraction operations. The issue is fixed in version 6.18.1.

CVE-2026-102994 is a high-severity vulnerability in the pypdf library prior to version 6.18.0. It involves uncontrolled resource consumption caused by crafted PDFs containing long sequences of indirect-object identifiers or generation-number tokens without whitespace. This leads to excessive scanning in specific pypdf modules, resulting in long runtimes and potential application unavailability. The issue is resolved in pypdf version 6.18.0.

CVE-2026-102993 is a high-severity vulnerability in the pypdf Python library prior to version 6.17.0. It involves uncontrolled resource consumption caused by processing crafted PDF files with unusually large Roman page-label values. This leads to excessive memory use and potential application unavailability. The issue is fixed in pypdf version 6.17.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ### Patches This has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/FlateDecode` filter with a PNG predictor. ### Patches This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3806](https://github.com/py-pdf/pypdf/pull/3806).

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. ### Patches This has been fixed in [pypdf==6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3796](https://github.com/py-pdf/pypdf/pull/3796).

CVE-2026-48155 is a medium severity vulnerability in the pypdf library prior to version 6.12.0. It allows an attacker to craft a PDF that causes uncontrolled resource consumption, specifically large memory usage, when extracting text in layout mode with large character offsets. This issue is fixed in pypdf version 6.12.0.