Threat Intelligence Database

A vulnerability in pdfly's pypdf component allows an attacker to craft a PDF that causes large memory consumption when retrieving Roman page labels. This issue affects versions from 0.4.0 up to but not including 0.5.1_26. The vulnerability has been fixed in pypdf version 6.17.0. If upgrading is not immediately possible, applying changes from the referenced pull request is recommended as a workaround.

A vulnerability in pdfly's pypdf library allows crafted PDF files with long indirect object headers not terminated by whitespace to cause long runtimes and large memory usage during parsing. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions from 0.4.0 up to but not including 0.5.1_26. An official fix is available in pypdf version 6.18.0. If upgrading is not immediately possible, applying the changes from pull request #4055 is recommended as a workaround.

A vulnerability in pdfly's pypdf component allows crafted PDF files with large /ToUnicode streams to cause excessive memory consumption during parsing. This issue can be triggered when processing fonts with unusually large /ToUnicode entries, such as during text extraction. The vulnerability has been addressed in pypdf version 6.18.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pdfly's pypdf component allows crafted PDFs with large font width values to cause excessive memory usage during parsing. This issue affects versions from 0.4.0 up to but not including 0.5.1_26. The vulnerability has been fixed in pypdf version 6.18.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pdfly's pypdf component allows crafted PDF files with partially malformed /FlateDecode streams to cause long runtimes during byte-by-byte decompression. This can lead to denial of service through resource exhaustion. The issue has been fixed in pypdf version 6.18.1. Users unable to upgrade immediately can apply a workaround from the referenced pull request.

A vulnerability in pdfly's pypdf library can cause long runtimes when generating appearance streams during form field value updates with flattening enabled. This issue has been fixed in version 6.19.0 of pypdf. Users unable to upgrade immediately can apply changes from a specific pull request as a workaround.

A vulnerability in pdfly's pypdf library allows crafted PDFs with many embedded files to cause long runtimes when accessed via the dictionary-based API. This can degrade performance but does not indicate code execution or data compromise. The issue is fixed in pypdf version 6.19.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pdfly's pypdf component allows an attacker to craft a PDF that causes large memory consumption when retrieving alphabetical page labels. This issue affects versions from 0.4.0 up to but not including 0.5.1_26. The vulnerability has been fixed in pypdf version 6.19.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

urllib3 versions prior to 2.8.0 have a vulnerability in their streaming API when handling chunked-transfer-encoded HTTP responses. The issue arises because the chunk-size field can be excessively large without newlines, causing unbounded memory buffering. This affects the read_chunked() and stream() methods, potentially leading to high memory consumption when processing maliciously crafted HTTP responses. The vulnerability is fixed in urllib3 2.8.0 by rejecting chunk-size fields larger than 65536 bytes.

urllib3 versions 2.6.2 through 2.7.0 have a vulnerability in their streaming API when handling HTTP responses with chunked Transfer-Encoding and deflate Content-Encoding. Under certain conditions, the decompression process can enter an infinite loop due to trailing bytes after the end of the Deflate stream, causing excessive CPU usage and preventing request completion.