Threat database

pypdf versions prior to 6.21.2 contain a vulnerability where repeated malformed cross-reference entries can cause excessive resource consumption by triggering complete PDF stream reloads during recovery attempts. This issue leads to long runtimes when processing crafted PDF files. The vulnerability is fixed in version 6.21.2.

A vulnerability in the pypdf library prior to version 6.21.2 allows an attacker to craft a PDF file with a cross-reference table declaring more entries than the file actually contains. This causes the library to perform excessive iteration, leading to long processing times when opening the file. The issue is addressed in version 6.21.2.

pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.

A resource exhaustion vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This vulnerability is fixed in version 2.8.8.

fpdf2, a Python PDF creation library, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 2.8.8. The shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through various image input methods, potentially causing outbound requests to attacker-chosen services or local file reads if the content is a valid image or SVG. The issue is fixed in version 2.8.8.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. ### Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. ### Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170). ### Notes This has been reported through both the secure channel and as a public issue at [#4169](https://github.com/py-pdf/pypdf/issues/4169).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. ### Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

CVE-2026-113791 is a medium severity vulnerability in the py-pdf pypdf library prior to version 6.21.0. It involves uncontrolled resource consumption where an attacker can craft a PDF with many small operations in a content stream, causing excessive memory usage during parsing. This issue has been fixed in version 6.21.0.

CVE-2026-113790 is a vulnerability in the pypdf library prior to version 6.21.0 where an attacker can craft a PDF with large arrays or dictionaries, causing excessive memory consumption during parsing. This uncontrolled resource consumption can lead to denial of service conditions. The issue is fixed in version 6.21.0.

CVE-2026-113789 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. It allows an attacker to craft a malicious PDF that triggers uncontrolled resource consumption, leading to excessive memory usage or prolonged processing times when the application extracts form fields from the document. This issue has been addressed and fixed in version 6.21.0.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data). Users which do not have the optional *Pillow* dependency installed in their environment are not affected. ### Patches This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).

CVE-2026-103000 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by unusually large alphabetical page-label values in crafted PDFs. This leads to excessive memory use and can potentially make applications using pypdf unavailable. The issue is fixed in version 6.19.0.

CVE-2026-102999 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by the dictionary-based attachments API reparsing the full attachment list repeatedly when processing crafted PDFs with many embedded files. This leads to excessive CPU usage and long runtimes during embedded-file mapping access. The issue is fixed in pypdf version 6.19.0.

CVE-2026-102998 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by inefficient processing of appearance-stream generation when updating PDF form fields with flattening enabled. This can lead to excessive runtimes and potential application unavailability. The issue is fixed in pypdf version 6.19.0.

pypdf versions prior to 6.18.1 contain a vulnerability where a crafted PDF with a malformed /FlateDecode stream causes inefficient byte-by-byte decompression. This leads to excessive resource consumption, resulting in long runtimes and potential application unavailability. The issue is a residual problem after a previous fix related to malformed FlateDecode recovery. The vulnerability is fixed in version 6.18.1.

CVE-2026-102996 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by processing an unusually large /Widths array in a crafted PDF's simple font. This leads to excessive memory usage during operations like text extraction. The issue is fixed in pypdf version 6.18.1.

CVE-2026-102995 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by crafted PDFs that place unusually large tokens in a font /ToUnicode mapping. This triggers excessive memory use during text extraction operations. The issue is fixed in version 6.18.1.

CVE-2026-102994 is a high-severity vulnerability in the pypdf library prior to version 6.18.0. It involves uncontrolled resource consumption caused by crafted PDFs containing long sequences of indirect-object identifiers or generation-number tokens without whitespace. This leads to excessive scanning in specific pypdf modules, resulting in long runtimes and potential application unavailability. The issue is resolved in pypdf version 6.18.0.