Pypdf Project Pypdf vulnerabilities

CVE-2026-59938 [MEDIUM] CWE-789 CVE-2026-59938: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.

CVE-2026-28351 [MEDIUM] CWE-400 CVE-2026-28351: pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who use pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.

CVE-2026-40260 [MEDIUM] CWE-776 CVE-2026-40260: pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XM pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.

CVE-2026-49461 [MEDIUM] CWE-400 CVE-2026-49461: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.

CVE-2026-27024 [MEDIUM] CWE-835 CVE-2026-27024: pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.

CVE-2026-27026 [MEDIUM] CWE-770 CVE-2026-27026: pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.

CVE-2026-27025 [MEDIUM] CWE-834 CVE-2026-27025: pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.

CVE-2026-54530 [MEDIUM] CWE-835 CVE-2026-54530: pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.

CVE-2026-54531 [MEDIUM] CWE-835 CVE-2026-54531: pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.

CVE-2026-54651 [MEDIUM] CWE-835 CVE-2026-54651: pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

CVE-2023-36464 [MEDIUM] CWE-835 CVE-2023-36464: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF w pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to

CVE-2023-46250 [MEDIUM] CWE-835 CVE-2023-46250: pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability presen pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when th

CVE-2026-84309 [MEDIUM] CWE-835 CVE-2026-84309: pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

CVE-2026-31826 [MEDIUM] CWE-770 CVE-2026-31826: pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this v pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.

CVE-2026-48735 [MEDIUM] CWE-770 CVE-2026-48735: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

CVE-2026-48155 [MEDIUM] CWE-400 CVE-2026-48155: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.

CVE-2026-24688 [MEDIUM] CWE-835 CVE-2026-24688: pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulne pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from

CVE-2026-113786 [LOW] CWE-183 pypdf: Unvalidated JPEG image data loading pypdf: Unvalidated JPEG image data loading ### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data). Users which do not have the optional *Pillow* dependency installed in their environment are not affected. ### Patches This has been fixed in [pypdf==6.21.1](https://github

CVE-2026-49460 [LOW] CWE-407 CVE-2026-49460: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

CVE-2026-84311 [LOW] CWE-834 CVE-2026-84311: pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causin