Pypdf Project Pypdf vulnerabilities

CVE-2026-33699 [HIGH] CWE-835 CVE-2026-33699: pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerabilit pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.

CVE-2026-102999 [HIGH] CWE-400 CVE-2026-102999: pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing m pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. Th

CVE-2026-59935 [HIGH] CWE-835 CVE-2026-59935: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

CVE-2026-59936 [HIGH] CWE-400 CVE-2026-59936: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

CVE-2025-55197 [HIGH] CWE-400 CVE-2025-55197: pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can cra pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.

CVE-2026-27888 [HIGH] CWE-400 CVE-2026-27888: pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround

CVE-2026-102995 [HIGH] CWE-400 CVE-2026-102995: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place un pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second fol

CVE-2026-59937 [HIGH] CWE-400 CVE-2026-59937: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

CVE-2025-62707 [HIGH] CWE-834 CVE-2025-62707: pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who use pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.

CVE-2026-27628 [HIGH] CWE-835 CVE-2026-27628: pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

CVE-2026-102997 [HIGH] CWE-400 CVE-2026-102997: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and applic

CVE-2026-102994 [HIGH] CWE-400 CVE-2026-102994: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing i pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and applica

CVE-2026-102996 [HIGH] CWE-400 CVE-2026-102996: pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operat

CVE-2026-102998 [HIGH] CWE-400 CVE-2026-102998: pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form fi pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application una

CVE-2026-103000 [HIGH] CWE-400 CVE-2026-103000: pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the applicat

CVE-2026-102993 [HIGH] CWE-400 CVE-2026-102993: pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavaila

CVE-2025-62708 [HIGH] CWE-409 CVE-2025-62708: pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who use pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.

CVE-2026-115572 [HIGH] CWE-400 pypdf: Possible long runtimes for repeated references to the same missing object pypdf: Possible long runtimes for repeated references to the same missing object ### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. ### Patches This has been fixed in [pypdf==6.21.2](https://gi

CVE-2026-115580 [HIGH] CWE-834 pypdf: Possible long runtimes for large xref table header limits pypdf: Possible long runtimes for large xref table header limits ### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. ### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ### Workarounds If you cannot upgrade yet, consider a

CVE-2025-66019 [MEDIUM] CWE-400 pypdf's LZWDecode streams be manipulated to exhaust RAM pypdf's LZWDecode streams be manipulated to exhaust RAM ### Impact An attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This is a follow up to [GHSA-jfx9-29x2-rv3j](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j) to align the default limit with t