pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values.
### Patches
This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3734](https://github.com/py-pdf/pypdf/pull/3734).
A vulnerability in the pypdf library prior to version 6.10.2 allows an attacker to craft a specially designed PDF that causes excessive memory allocation, leading to RAM exhaustion. This occurs when processing a stream compressed with /FlateDecode using a /Predictor value other than 1 and large predictor parameters. The issue has been fixed in pypdf version 6.10.2. No known exploits are reported in the wild. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-41313 is a medium severity vulnerability in the pypdf library prior to version 6.10.2. It involves excessive iteration caused by loading a crafted PDF with a large trailer /Size value in incremental mode, leading to long runtimes. This issue has been fixed in pypdf version 6.10.2. Users can also manually apply the patch changes as a workaround.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values.
### Patches
This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3733](https://github.com/py-pdf/pypdf/pull/3733).
CVE-2026-40260 is a medium severity vulnerability in the py-pdf pypdf library versions prior to 6.10.0. It involves improper restriction of recursive entity references in XML DTDs, specifically in XMP metadata parsing. An attacker can craft a PDF with manipulated XMP metadata entity declarations that cause excessive memory consumption, potentially exhausting system RAM. This vulnerability has been fixed in pypdf version 6.10.0.
pypdf versions prior to 6.9.2 contain a vulnerability where processing a specially crafted PDF file in non-strict mode can cause an infinite loop. This issue is classified as CWE-835 (Loop with Unreachable Exit Condition). The vulnerability has been fixed in version 6.9.2. Users unable to upgrade immediately may consider manually applying the patch changes.
CVE-2026-33123 is a medium severity vulnerability in the py-pdf pypdf library versions prior to 6.9.1. It allows an attacker to craft a malicious PDF that triggers uncontrolled resource consumption, causing long runtimes or excessive memory usage. Exploitation requires processing a specially crafted array-based stream with many entries, potentially leading to denial of service due to resource exhaustion. No authentication or user interaction is required, and the vulnerability affects systems that parse untrusted PDFs using vulnerable pypdf versions. The issue has been fixed in version 6.9.1. There are no known exploits in the wild currently.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large `/Length` value, regardless of the actual data length inside the stream.
### Patches
This has been fixed in [pypdf==6.8.0](https://github.com/py-pdf/pypdf/releases/tag/6.8.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3675](https://github.com/py-pdf/pypdf/pull/3675).
As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by `open("file.pdf", mode="rb")` for example. Passing a file path or a `BytesIO` buffer to *pypdf* instead does not seem to trigger the vulnerability.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter.
### Patches
This has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3666](https://github.com/py-pdf/pypdf/pull/3666).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.
### Patches
This has been fixed in [pypdf==6.7.4](https://github.com/py-pdf/pypdf/releases/tag/6.7.4).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3664](https://github.com/py-pdf/pypdf/pull/3664).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`.
### Patches
This has been fixed in [pypdf==6.7.3](https://github.com/py-pdf/pypdf/releases/tag/6.7.3).
### Workarounds
If projects cannot upgrade yet, consider applying the changes from PR [#3658](https://github.com/py-pdf/pypdf/pull/3658).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.
### Patches
This has been fixed in [pypdf==6.7.2](https://github.com/py-pdf/pypdf/releases/tag/6.7.2).
### Workarounds
If users cannot upgrade yet, consider applying the changes from PR [#3655](https://github.com/py-pdf/pypdf/pull/3655).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.
### Patches
This has been fixed in [pypdf 6.6.2](https://github.com/py-pdf/pypdf/releases/tag/6.6.2).
### Workarounds
If projects cannot upgrade yet, consider applying the changes from PR [#3610](https://github.com/py-pdf/pypdf/pull/3610).
### Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.
### Patches
This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).
### Workarounds
```python
from pypdf import PdfReader, PdfWriter
# Instead of
reader = PdfReader("file.pdf")
# use the strict mode:
reader = PdfReader("file.pdf", strict=True)
# Instead of
writer = PdfWriter(clone_from="file.pdf")
# use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```
### Resources
This issue has been fixed in #3594.
### Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected.
### Patches
This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).
### Workarounds
```python
from pypdf import PdfReader, PdfWriter
# Instead of
reader = PdfReader("file.pdf")
# use the strict mode:
reader = PdfReader("file.pdf", strict=True)
# Instead of
writer = PdfWriter(clone_from="file.pdf")
# use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```
### Resources
This issue has been fixed in #3594.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter.
This is a follow up to [GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) to align the default limit with the one for *zlib*.
### Patches
This has been fixed in [pypdf==6.4.0](https://github.com/py-pdf/pypdf/releases/tag/6.4.0).
### Workarounds
If users cannot upgrade yet, use the line below to overwrite the default in their code:
```python
pypdf.filters.LZW_MAX_OUTPUT_LENGTH = 75_000_000
```