Threats affecting pkg:brew/pdfalyzer

CVE-2026-119209 is a vulnerability in the pdfalyzer tool (pypdf library) that allows an attacker to craft a PDF file with cross-reference streams causing large memory usage when parsed. This can lead to denial of service due to resource exhaustion. The issue affects versions starting from 1.16.1. A fix is available in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from the referenced pull request #4269 is recommended as a workaround.

CVE-2026-119208 is a vulnerability in pypdf (pdfalyzer) that allows an attacker to craft an encrypted PDF file with a manipulated /Count value, causing excessive runtimes and large memory usage when accessing the page count. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions starting from 1.16.1 and has been fixed in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in pdfalyzer's pypdf component that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from the referenced pull request #4265 is recommended as a workaround.

CVE-2026-119206 is a vulnerability in the pdfalyzer product related to the pypdf library. It allows an attacker to craft a PDF file that causes long runtimes when retrieving page labels. This can lead to performance degradation or denial of service. The issue affects versions of pdfalyzer using pypdf from 1.16.1 onward. A fix is available in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from pull request #4251 is recommended as a workaround.

CVE-2026-119205 is a vulnerability in pdfalyzer's pypdf component where cloning a DictionaryObject can cause an infinite loop. This flaw allows an attacker to craft a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the patch from the referenced pull request.

CVE-2026-119204 is a vulnerability in the pdfalyzer product related to the pypdf library. It allows an attacker to craft a malicious PDF that causes large memory usage during parsing of the page tree with many shared resources. This can lead to high resource consumption on the affected system. A fix is available in pypdf version 6.21.4. If upgrading is not possible, applying the changes from pull request #4290 is recommended as a workaround.

A vulnerability in pdfalyzer (pypdf) allows an attacker to craft a PDF file that causes an infinite loop when the parser encounters an incomplete file missing a trailer during the standard cross-reference table trailer search.