CVE-2026-102998

pypdf: Possible long runtimes when generating appearance streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-102999

pypdf: Possible long runtimes with large amount of embedded files

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-103000

pypdf: Possible large memory usage when retrieving alphabetical page labels

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-119203

pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-119209

pypdf: Possible large memory usage when parsing cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-22690

pypdf has possible long runtimes for missing /Root object with large /Size values

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-22691

pypdf has possible long runtimes for malformed startxref

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-27024

pypdf has a possible infinite loop when processing TreeObject

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-27025

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-27026

pypdf possibly has long runtimes for malformed FlateDecode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-28804

pypdf: Inefficient decoding of ASCIIHexDecode streams

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-41168

pypdf has possible long runtimes for wrong size values in cross-reference and object streams

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf Pypdf Project

Products

Pypdf Pypdf

CVE-2026-48735

pypdf: Manipulated XMP metadata streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-54531

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-57204

pypdf: Missing stream length values ignore defined limits

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-59937

pypdf: Possible long runtimes for repeated malformed cross-reference entries

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-71852

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-82398

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-84309

pypdf: Possible infinite loop for TreeObject.insert_child

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-84310

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf