Threats affecting pkg:pypi/pypdf

pypdf versions prior to 6.21.4 contain a vulnerability where opening an incomplete PDF file without a trailer can cause an infinite loop during the search for the standard xref table. This flaw allows an attacker to craft a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.21.4.

A high-severity vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that causes large memory usage when parsing the page tree with many shared resources. This issue has been fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that triggers an infinite loop when cloning a DictionaryObject. This flaw has been assigned CVE-2026-119205 and is rated high severity with a CVSS score of 7.1. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf versions prior to 6.21.3 can cause long runtimes when retrieving page labels from a crafted PDF file. This issue has been fixed in version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf prior to version 6.21.3 allows an attacker to craft a malicious PDF that triggers large memory usage when loading an invalid dictionary in strict mode. This can lead to denial of service due to resource exhaustion. The issue has been fixed in pypdf version 6.21.3.

CVE-2026-119208 is a vulnerability in pypdf versions prior to 6.21.3 where an attacker can craft an encrypted PDF file with a manipulated /Count value. Accessing the page count of such a PDF can cause excessive runtimes and large memory usage. This issue has been fixed in pypdf version 6.21.3.

A vulnerability in pypdf prior to version 6.21.3 allows an attacker to craft a PDF file with cross-reference streams that causes large memory usage when parsed. This issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf prior to version 6.21.2 allows crafted PDF files with malformed cross-reference streams to cause excessive resource consumption. This occurs because an incomplete fix for repeated malformed cross-reference entries causes the library to reload the entire PDF stream multiple times during recovery attempts, leading to long runtimes. The issue is resolved in version 6.21.2.

A vulnerability in pypdf versions prior to 6.21.2 allows an attacker to craft a PDF with a cross-reference table declaring more entries than the file actually contains. This causes excessive processing and long runtimes when the file is opened. The issue is fixed in version 6.21.2.

pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.

CVE-2026-113795 is a vulnerability in the py-pdf pypdf library prior to version 6.20.0. It involves uncontrolled resource consumption caused by processing crafted PDF streams with many filters or multiple filters that handle large data volumes. This can lead to excessive memory usage. The issue is resolved in version 6.20.0.

pypdf versions prior to 6.20.0 contain a vulnerability where processing a crafted incomplete PDF file that ends inside a standard cross-reference table can cause the library to enter an infinite loop. This issue is resolved in version 6.20.0.

CVE-2026-113793 is a medium severity vulnerability in the pypdf library prior to version 6.20.1. The issue involves an infinite loop triggered when removing an object from a crafted cyclic PDF tree, such as an outline item, which can block the current process. This flaw is fixed in version 6.20.1.

An infinite loop vulnerability exists in pypdf versions prior to 6.20.1. Specifically, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can cause the process to hang indefinitely. This issue is resolved in version 6.20.1.

A vulnerability in pypdf prior to version 6.21.0 allows an attacker to craft a PDF with a content stream containing many small operations, leading to excessive memory consumption during parsing. This uncontrolled resource consumption issue is fixed in version 6.21.0.

CVE-2026-113790 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. An attacker can craft a malicious PDF containing arrays or dictionaries with many elements, causing excessive memory consumption during parsing. This uncontrolled resource consumption can lead to denial of service. The issue is fixed in version 6.21.0.

CVE-2026-113789 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. It allows an attacker to craft a malicious PDF that triggers excessive memory consumption or prolonged runtimes when an application processes the document's form fields. This uncontrolled resource consumption issue is addressed in pypdf version 6.21.0.

CVE-2026-113786 is an improper input validation vulnerability in the py-pdf pypdf library prior to version 6.21.1. An attacker can craft a PDF with image data labeled with the /DCTDecode filter that causes the Pillow library to invoke an unintended image parser when loading the image. This issue only affects environments where the optional Pillow dependency is installed. The vulnerability is fixed in pypdf version 6.21.1.

CVE-2026-103000 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by unusually large alphabetical page-label values in crafted PDFs. This leads to excessive memory use and can potentially make applications using pypdf unavailable. The issue is fixed in version 6.19.0.

CVE-2026-102999 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by the dictionary-based attachments API reparsing the full attachment list repeatedly when processing crafted PDFs with many embedded files. This leads to excessive CPU usage and long runtimes during embedded-file mapping access. The issue is fixed in pypdf version 6.19.0.