### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.
### Patches
This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
A vulnerability in virtualenv allows attacker-controlled prompt text to be interpreted as executable commands in certain older or less common shell compatibility modes. Specifically, when bash runs with compatibility level 4.2 or lower, or when dash shells inherit an exported PS1 prompt variable, the prompt text can be executed upon drawing the prompt. This occurs because the prompt string is expanded twice, and some paths do not properly escape the prompt text. The issue affects POSIX activation scripts generated by virtualenv versions prior to 2.20.0_1 and 4.7.0_1. The vulnerability requires an attacker to supply malicious prompt text and a user to activate the environment and interact with the shell prompt. A fix is available in virtualenv versions 2.20.0_1 and 4.7.0_1.
A vulnerability in virtualenv's app-data copy seeder causes files copied from a cache to retain their original permissions, potentially wider than intended. This occurs because shutil.copy preserves cached file modes regardless of the current umask, allowing files created under permissive umask 000 to be copied with mode 0666 in later environments. An attacker with local access and the ability to traverse the environment can exploit this to modify files such as pip/__init__.py, leading to code execution as the environment owner. The issue affects virtualenv versions prior to 2.20.0_1 and 4.7.0_1. A fix is available that enforces stricter file permissions on copied files.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when distribution metadata contains paths that traverse outside the environment, allowing deletion of arbitrary files if the invoking user has permissions. This affects reuse of environments containing metadata influenced by another account. The issue was introduced in version 20.8.1 and fixed in versions 2.20.0_1 and 4.7.0_1.
A vulnerability in virtualenv's xonsh activation script allows attacker-controlled prompt text to become executable code during environment activation if the script is decoded using legacy multibyte encodings like GBK or Big5. This occurs because the UTF-8 activation script contains non-ASCII characters that, when decoded under these encodings, alter how quotes are interpreted, enabling code injection. The attack requires control of the prompt or destination argument passed to virtualenv and subsequent sourcing of the generated activation script. The issue affects POSIX activation scripts and is fixed by changing the quoting method to emit only ASCII escapes.
CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because the pip seeder downloads wheels without performing virtualenv's wheel digest verification, allowing an attacker-controlled index to serve a modified pip wheel that bypasses integrity checks. This can lead to installation of tampered pip code in the created environment. Both --seeder pip and --download options must be enabled for exploitation. The vulnerability was reported by Anthropic's OSS Scanner and fixed in virtualenv version 4.7.0_1.
A vulnerability in virtualenv's wheel download and caching mechanism allows a downloaded wheel to be cached before verification completes. An attacker-controlled package index can cause a mismatch between the downloaded file and the file verified by virtualenv, leading to reuse of unverified or tampered wheels from the cache. This issue affects virtualenv versions from 4.6.2_1 up to but not including 4.7.0_1 and was fixed in version 4.7.0_1.
A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during readback. This can alter environment settings such as 'home' and 'include-system-site-packages', potentially changing which standard library files the interpreter loads and weakening environment isolation. The issue affects virtualenv versions starting from 20.0.0b1 until fixed in 2.20.0_1 and 4.7.0_1. The vulnerability is low severity with a CVSS 4.0 score of 2. A patch is available that rejects line-boundary characters before creation and rebuilds the configuration from selected settings.
A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. This file has fixed content and is created with the installer's permissions. The issue arises because an absolute Windows path in namespace_packages.txt is not properly validated, leading to path escape. The vulnerability affects setuptools versions from 1.78.1 up to but not including 1.86.0_6 and is fixed in version 1.86.0_6.
A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The file content is fixed and the path is attacker-influenced but requires the target directory to pre-exist. This can lead to unauthorized file creation with the installer's permissions.
A vulnerability in the Include directive of Mistune (used in JupyterLab) allows path traversal via '../' sequences to read arbitrary files outside the intended source directory. Additionally, error messages and included file contents are rendered without HTML escaping, enabling cross-site scripting (XSS) even when escaping is enabled. The Include plugin must be explicitly enabled to be exploitable. This issue affects JupyterLab versions from 3.4.7 up to but not including 4.6.1 and is fixed in version 4.6.1.