chore(deps): update dependency pypdf to v6.16.1 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	6.6.1 → 6.16.1

---

pypdf has possible Infinite Loop when processing outlines/bookmarks

CVE-2026-24688 / GHSA-2q4j-m29v-hq73

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.

Patches

This has been fixed in pypdf 6.6.2.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3610.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73
• https://github.com/py-pdf/pypdf/pull/3610
• https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1
• https://github.com/py-pdf/pypdf/releases/tag/6.6.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-24688
• https://github.com/advisories/GHSA-2q4j-m29v-hq73

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has a possible infinite loop when processing TreeObject

CVE-2026-27024 / GHSA-996q-pr4m-cvgq

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3645.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq
• https://github.com/py-pdf/pypdf/pull/3645
• https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27024
• https://github.com/advisories/GHSA-996q-pr4m-cvgq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

CVE-2026-27025 / GHSA-wgvp-vg3v-2xq3

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3646.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3
• https://github.com/py-pdf/pypdf/pull/3646
• https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27025
• https://github.com/advisories/GHSA-wgvp-vg3v-2xq3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf possibly has long runtimes for malformed FlateDecode streams

CVE-2026-27026 / GHSA-9mvc-8737-8j8h

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3644.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h
• https://github.com/py-pdf/pypdf/pull/3644
• https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27026
• https://github.com/advisories/GHSA-9mvc-8737-8j8h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

CVE-2026-27628 / GHSA-2rw7-x74f-jg35

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.

Patches

This has been fixed in pypdf==6.7.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3655.

Severity

• CVSS Score: 1.2 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35
• https://nvd.nist.gov/vuln/detail/CVE-2026-27628
• https://github.com/py-pdf/pypdf/issues/3654
• https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d
• https://github.com/advisories/GHSA-2rw7-x74f-jg35

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

CVE-2026-27888 / GHSA-x7hp-r3qg-r3cj

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode.

Patches

This has been fixed in pypdf==6.7.3.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3658.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj
• https://nvd.nist.gov/vuln/detail/CVE-2026-27888
• https://github.com/py-pdf/pypdf/pull/3658
• https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c
• https://github.com/py-pdf/pypdf/releases/tag/6.7.3
• https://github.com/advisories/GHSA-x7hp-r3qg-r3cj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated RunLengthDecode streams can exhaust RAM

CVE-2026-28351 / GHSA-f2v5-7jq9-h8cg

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.

Patches

This has been fixed in pypdf==6.7.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3664.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg
• https://nvd.nist.gov/vuln/detail/CVE-2026-28351
• https://github.com/py-pdf/pypdf/pull/3664
• https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858
• https://github.com/py-pdf/pypdf/releases/tag/6.7.4
• https://github.com/advisories/GHSA-f2v5-7jq9-h8cg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

CVE-2026-28804 / GHSA-9m86-7pmv-2852

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter.

Patches

This has been fixed in pypdf==6.7.5.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3666.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852
• https://github.com/py-pdf/pypdf/pull/3666
• https://github.com/py-pdf/pypdf/releases/tag/6.7.5
• https://nvd.nist.gov/vuln/detail/CVE-2026-28804
• https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f
• https://github.com/advisories/GHSA-9m86-7pmv-2852

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: manipulated stream length values can exhaust RAM

CVE-2026-31826 / GHSA-hqmh-ppp3-xvm7

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream.

Patches

This has been fixed in pypdf==6.8.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3675.

As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by open("file.pdf", mode="rb") for example. Passing a file path or a BytesIO buffer to pypdf instead does not seem to trigger the vulnerability.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7
• https://github.com/py-pdf/pypdf/pull/3675
• https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa
• https://github.com/py-pdf/pypdf/releases/tag/6.8.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-31826
• https://github.com/advisories/GHSA-hqmh-ppp3-xvm7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has inefficient decoding of array-based streams

CVE-2026-33123 / GHSA-qpxp-75px-xjcp

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.

Patches

This has been fixed in pypdf==6.9.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3686.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp
• https://github.com/py-pdf/pypdf/pull/3686
• https://github.com/py-pdf/pypdf/releases/tag/6.9.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33123
• https://github.com/advisories/GHSA-qpxp-75px-xjcp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

CVE-2026-33699 / GHSA-87mj-5ggw-8qc3

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3693.

Severity

• CVSS Score: 4.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3
• https://github.com/py-pdf/pypdf/pull/3693
• https://github.com/py-pdf/pypdf/releases/tag/6.9.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-33699
• https://github.com/advisories/GHSA-87mj-5ggw-8qc3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx
• https://github.com/py-pdf/pypdf/pull/3724
• https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8
• https://github.com/py-pdf/pypdf/releases/tag/6.10.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-40260
• https://github.com/advisories/GHSA-3crg-w4f6-42mx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has long runtimes for wrong size values in cross-reference and object streams

CVE-2026-41168 / GHSA-jj6c-8h6c-hppx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx
• https://github.com/py-pdf/pypdf/pull/3733
• https://github.com/py-pdf/pypdf/releases/tag/6.10.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-41168
• https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3
• https://github.com/advisories/GHSA-jj6c-8h6c-hppx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for wrong size values in incremental mode

CVE-2026-41313 / GHSA-4pxv-j86v-mhcw

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw
• https://github.com/py-pdf/pypdf/pull/3735
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41313
• https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a
• https://github.com/advisories/GHSA-4pxv-j86v-mhcw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

CVE-2026-41312 / GHSA-7gw9-cf7v-778f

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f
• https://github.com/py-pdf/pypdf/pull/3734
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41312
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
• https://github.com/advisories/GHSA-7gw9-cf7v-778f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

CVE-2026-41314 / GHSA-x284-j5p8-9c5p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p
• https://github.com/py-pdf/pypdf/pull/3734
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41314
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
• https://github.com/advisories/GHSA-x284-j5p8-9c5p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

CVE-2026-48156 / GHSA-248m-82v9-q6g6

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #​3791.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6
• https://nvd.nist.gov/vuln/detail/CVE-2026-48156
• https://github.com/py-pdf/pypdf/pull/3791
• https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-248m-82v9-q6g6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large offsets for layout mode text

CVE-2026-48155 / GHSA-cj93-chg6-vgv8

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to immediately upgrade, they should consider applying the changes from PR #​3790.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48155
• https://github.com/py-pdf/pypdf/pull/3790
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-cj93-chg6-vgv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for form XObjects during text extraction

CVE-2026-49461 / GHSA-j543-4vmf-qm7v

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3805.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v
• https://github.com/py-pdf/pypdf/pull/3805
• https://github.com/py-pdf/pypdf/releases/tag/6.12.2
• https://github.com/advisories/GHSA-j543-4vmf-qm7v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

CVE-2026-49460 / GHSA-5hgr-hg42-57jg

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3806.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
• https://github.com/py-pdf/pypdf/pull/3806
• https://github.com/py-pdf/pypdf/releases/tag/6.12.2
• https://github.com/advisories/GHSA-5hgr-hg42-57jg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

CVE-2026-54530 / GHSA-52x6-gq3r-vpf4

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4
• https://github.com/py-pdf/pypdf/pull/3830
• https://github.com/py-pdf/pypdf/releases/tag/6.13.0
• https://github.com/advisories/GHSA-52x6-gq3r-vpf4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

CVE-2026-54531 / GHSA-m2v9-299j-rv96

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96
• https://github.com/py-pdf/pypdf/pull/3830
• https://github.com/py-pdf/pypdf/releases/tag/6.13.0
• https://github.com/advisories/GHSA-m2v9-299j-rv96

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Missing stream length values ignore defined limits

GHSA-jm82-fx9c-mx94

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value.

Patches

This has been fixed in pypdf==6.13.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3871.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94
• https://github.com/py-pdf/pypdf/pull/3871
• https://github.com/py-pdf/pypdf/releases/tag/6.13.3
• https://github.com/advisories/GHSA-jm82-fx9c-mx94

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated XMP metadata streams can exhaust RAM

CVE-2026-48735 / GHSA-wjqc-6w8f-h24c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

Patches

This has been fixed in pypdf==6.12.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3796.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
• https://nvd.nist.gov/vuln/detail/CVE-2026-48735
• https://github.com/py-pdf/pypdf/pull/3796
• https://github.com/py-pdf/pypdf/releases/tag/6.12.1
• https://github.com/advisories/GHSA-wjqc-6w8f-h24c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop when processing threads/articles in writer

CVE-2026-54651 / GHSA-g9xf-7f8q-9mcj

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer.

Patches

This has been fixed in pypdf==6.13.1.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3839.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj
• https://nvd.nist.gov/vuln/detail/CVE-2026-54651
• https://github.com/py-pdf/pypdf/pull/3839
• https://github.com/py-pdf/pypdf/releases/tag/6.13.1
• https://github.com/advisories/GHSA-g9xf-7f8q-9mcj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for wrong image dimensions

CVE-2026-59938 / GHSA-5qjq-93h5-hrgp

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3888.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp
• https://nvd.nist.gov/vuln/detail/CVE-2026-59938
• https://github.com/py-pdf/pypdf/pull/3888
• https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a
• https://github.com/py-pdf/pypdf/releases/tag/6.14.0
• https://github.com/advisories/GHSA-5qjq-93h5-hrgp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for repeated malformed cross-reference entries

CVE-2026-59937 / GHSA-55h5-xmcq-c37v

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3887.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v
• https://nvd.nist.gov/vuln/detail/CVE-2026-59937
• https://github.com/py-pdf/pypdf/pull/3887
• https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae
• https://github.com/py-pdf/pypdf/releases/tag/6.14.0
• https://github.com/advisories/GHSA-55h5-xmcq-c37v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop for not terminated inline images

CVE-2026-59936 / GHSA-5xf7-4p34-54qr

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.

Patches

This has been fixed in pypdf==6.14.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3891.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr
• https://nvd.nist.gov/vuln/detail/CVE-2026-59936
• https://github.com/py-pdf/pypdf/pull/3891
• https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b
• https://github.com/py-pdf/pypdf/releases/tag/6.14.1
• https://github.com/advisories/GHSA-5xf7-4p34-54qr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

CVE-2026-59935 / GHSA-g867-7843-wf8q

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.

Patches

This has been fixed in pypdf==6.14.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3892.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q
• https://nvd.nist.gov/vuln/detail/CVE-2026-59935
• https://github.com/py-pdf/pypdf/pull/3892
• https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2
• https://github.com/py-pdf/pypdf/releases/tag/6.14.2
• https://github.com/advisories/GHSA-g867-7843-wf8q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

CVE-2026-71852 / GHSA-fwg2-594c-jp42

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3946.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42
• https://github.com/py-pdf/pypdf/pull/3946
• https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fwg2-594c-jp42

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large /ToUnicode streams

CVE-2026-71870 / GHSA-fp3f-mc75-235c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3944.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c
• https://github.com/py-pdf/pypdf/pull/3944
• https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fp3f-mc75-235c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop for TreeObject.insert_child

CVE-2026-84309 / GHSA-jp53-mhqp-8xcg

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insert_child is involved.

Patches

This has been fixed in pypdf==6.16.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3964.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg
• [https://github.com/py-p

✂ Note

PR body was truncated to here.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/pypdf	6.17.0	Unknown	Unknown

Scanned Files

• poetry.lock

[github-actions]

Test Results (Python 3.14)

183 tests  ±0   183 ✅ ±0   21s ⏱️ +3s
  1 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit c3167e6. ± Comparison against base commit b1fd94d.

♻️ This comment has been updated with latest results.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[github-actions]

Combined Test Results

  5 files  ±0    5 suites  ±0   1m 16s ⏱️ +4s
183 tests ±0  183 ✅ ±0  0 💤 ±0  0 ❌ ±0 
915 runs  ±0  915 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit c3167e6. ± Comparison against base commit b1fd94d.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!