Pypdf Project Pypdf vulnerabilities

CVE-2026-84310 [LOW] CWE-405 CVE-2026-84310: pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PD pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting

CVE-2026-71852 [LOW] CWE-834 CVE-2026-71852: pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause lo pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

CVE-2026-71870 [LOW] CWE-400 CVE-2026-71870: pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause la pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

CVE-2026-48156 [LOW] CWE-834 CVE-2026-48156: pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.