Threats affecting pkg:brew/psutils

CVE-2026-119209 is a vulnerability in pypdf used by psutils that allows an attacker to craft a PDF file with cross-reference streams causing large memory usage when parsed. This can lead to resource exhaustion on the system processing the malicious PDF. The issue has been fixed in pypdf version 6.21.3.

A vulnerability in psutils' pypdf component allows an attacker to craft encrypted PDF files with incorrect page count values, causing excessive runtimes and large memory usage when accessing the page count. This issue has been fixed in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in the psutils product affecting versions 3.0 and later. It allows an attacker to craft a malicious PDF that triggers large memory usage by loading an invalid dictionary in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-119206 is a vulnerability in the pypdf library used by psutils that allows an attacker to craft a malicious PDF file causing long runtimes when retrieving page labels. This can lead to denial of service due to resource exhaustion. The issue affects pypdf versions 3.0 and later and has been fixed in version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in psutils' pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service by exhausting resources. The issue affects versions 3.0 and later and has been fixed in pypdf version 6.21.4.

CVE-2026-119204 is a vulnerability in the pypdf library used by psutils that can cause large memory usage when parsing a PDF page tree with many shared resources. This issue can be triggered by an attacker crafting a malicious PDF. The vulnerability is fixed in pypdf version 6.21.4.

A vulnerability in psutils' pypdf library allows an attacker to craft a PDF file that causes an infinite loop when the file is incomplete and lacks a trailer section. This issue is fixed in pypdf version 6.21.4.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. ### Patches This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2). ### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. ### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3735](https://github.com/py-pdf/pypdf/pull/3735).

Pypdf2 versions prior to 6.14.2 have a vulnerability where parsing a PDF page containing a not terminated inline image using ASCII85 or ASCIIHex filters can cause an infinite loop during content stream parsing, such as when extracting page text. This issue has been fixed in version 6.14.2.

Pypdf2 versions prior to 6.14.1 have a vulnerability where parsing a PDF page containing a not terminated inline image in the content stream can cause an infinite loop during operations like text extraction. This issue has been fixed in version 6.14.1.

Pypdf2 versions prior to 6.14.0 have a vulnerability where specially crafted PDFs with repeated malformed cross-reference streams cause excessive processing time, potentially leading to denial of service. This issue has been fixed in version 6.14.0. If upgrading is not possible immediately, applying the referenced pull request changes is recommended.

CVE-2026-59938 is a vulnerability in pypdf2 versions prior to 6.14.0 where an attacker can craft a PDF with image size declarations that are much larger than the actual image data, causing excessive memory usage during processing. This issue has been fixed in pypdf version 6.14.0. A workaround is available by applying changes from pull request #3888 if immediate upgrading is not possible.