pypdf
PyPI69 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting pypdfpage 1 of 2
- CVE-2023-36464MEDIUMCVSS 5.5EG 6.2fixed in 3.9.02023-06-27
vulnerable: 3.1.0 ... 3.8.1 (14 versions)
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such…
- CVE-2023-46250MEDIUMCVSS 5.5EG 5.5fixed in 3.17.02023-10-31
vulnerable: 3.10.0 ... 3.9.1 (25 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can u…
- CVE-2025-55197HIGHCVSS 7.5EG 7.5fixed in 6.0.02025-08-13
vulnerable: 1.0 ... 5.9.0 (74 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malici…
- CVE-2025-62707HIGHCVSS 7.5EG 7.5fixed in 6.1.32025-10-22
vulnerable: 1.0 ... 6.1.2 (78 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inlin…
- CVE-2025-62708HIGHCVSS 7.5EG 7.5fixed in 6.1.32025-10-22
vulnerable: 1.0 ... 6.1.2 (78 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDec…
- CVE-2025-66019MEDIUMCVSS 6.6EG 6.6fixed in 6.4.02025-11-26
vulnerable: 1.0 ... 6.3.0 (81 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a …
- CVE-2026-102993HIGHCVSS 7.5EG 7.5fixed in 6.17.02026-09-30
vulnerable: 1.0 ... 6.9.2 (116 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application …
- CVE-2026-102994HIGHCVSS 7.5EG 7.5fixed in 6.18.02026-09-30
vulnerable: 1.0 ... 6.9.2 (117 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypd…
- CVE-2026-102995HIGHCVSS 7.5EG 7.5fixed in 6.18.12026-09-30
vulnerable: 1.0 ... 6.9.2 (118 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and reta…
- CVE-2026-102996HIGHCVSS 7.5EG 7.5fixed in 6.18.12026-09-30
vulnerable: 1.0 ... 6.9.2 (118 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to proce…
- CVE-2026-102997HIGHCVSS 7.5EG 7.5fixed in 6.18.12026-09-30
vulnerable: 1.0 ... 6.9.2 (118 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while th…
- CVE-2026-102998HIGHCVSS 7.5EG 7.5fixed in 6.19.02026-09-30
vulnerable: 1.0 ... 6.9.2 (119 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop…
- CVE-2026-102999HIGHCVSS 7.5EG 7.5fixed in 6.19.02026-09-30
vulnerable: 1.0 ... 6.9.2 (119 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each cont…
- CVE-2026-103000HIGHCVSS 7.5EG 7.5fixed in 6.19.02026-09-30
vulnerable: 1.0 ... 6.9.2 (119 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length w…
- CVE-2026-113786LOWCVSS 2.3EG 2.3fixed in 6.21.12026-10-21
vulnerable: 1.0 ... 6.9.2 (123 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the imag…
- CVE-2026-113789LOWCVSS 3.3EG 3.3fixed in 6.21.02026-10-21
vulnerable: 1.0 ... 6.9.2 (122 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version …
- CVE-2026-113790MEDIUMCVSS 6.0EG 6.0fixed in 6.21.02026-10-21
vulnerable: 1.0 ... 6.9.2 (122 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version …
- CVE-2026-113791MEDIUMCVSS 6.0EG 6.0fixed in 6.21.02026-10-21
vulnerable: 1.0 ... 6.9.2 (122 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in versio…
- CVE-2026-113792MEDIUMCVSS 6.0EG 6.0fixed in 6.20.12026-10-21
vulnerable: 1.0 ... 6.9.2 (121 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in…
- CVE-2026-113793MEDIUMCVSS 6.0EG 6.0fixed in 6.20.12026-10-21
vulnerable: 1.0 ... 6.9.2 (121 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version …
- CVE-2026-113794MEDIUMCVSS 5.5EG 5.5fixed in 6.20.02026-10-21
vulnerable: 1.0 ... 6.9.2 (120 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinit…
- CVE-2026-113795MEDIUMCVSS 5.5EG 5.5fixed in 6.20.02026-10-21
vulnerable: 1.0 ... 6.9.2 (120 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This iss…
- CVE-2026-115572HIGHCVSS 7.1EG 7.1fixed in 6.21.22026-10-23
vulnerable: 1.0 ... 6.9.2 (124 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file …
- CVE-2026-115580HIGHCVSS 7.1EG 7.1fixed in 6.21.22026-10-23
vulnerable: 1.0 ... 6.9.2 (124 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long…
- CVE-2026-115585HIGHCVSS 7.1EG 7.1fixed in 6.21.22026-10-23
vulnerable: 1.0 ... 6.9.2 (124 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery…
- CVE-2026-119203MEDIUMCVSS 5.5EG 5.5fixed in 6.21.42026-10-29
vulnerable: 1.0 ... 6.9.2 (126 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trail…
- CVE-2026-119204MEDIUMCVSS 5.5EG 5.5fixed in 6.21.42026-10-29
vulnerable: 1.0 ... 6.9.2 (126 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited …
- CVE-2026-119205MEDIUMCVSS 5.5EG 5.5fixed in 6.21.42026-10-29
vulnerable: 1.0 ... 6.9.2 (126 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than …
- CVE-2026-119206MEDIUMCVSS 5.5EG 5.5fixed in 6.21.32026-10-29
vulnerable: 1.0 ... 6.9.2 (125 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves…
- CVE-2026-119207MEDIUMCVSS 5.5EG 5.5fixed in 6.21.32026-10-29
vulnerable: 1.0 ... 6.9.2 (125 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised error…
- CVE-2026-119208MEDIUMCVSS 5.5EG 5.5fixed in 6.21.32026-10-29
vulnerable: 1.0 ... 6.9.2 (125 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Ev…
- CVE-2026-119209MEDIUMCVSS 5.5EG 5.5fixed in 6.21.32026-10-29
vulnerable: 1.0 ... 6.9.2 (125 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams a…
- CVE-2026-22690MEDIUMCVSS 5.3EG 5.3fixed in 6.6.02026-01-10
vulnerable: 1.0 ... 6.5.0 (85 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to poss…
- CVE-2026-22691MEDIUMCVSS 5.3EG 5.3fixed in 6.6.02026-01-10
vulnerable: 1.0 ... 6.5.0 (85 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for in…
- CVE-2026-24688MEDIUMCVSS 4.3EG 4.3fixed in 6.6.22026-01-27
vulnerable: 1.0 ... 6.6.1 (87 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/b…
- CVE-2026-27024MEDIUMCVSS 5.5EG 5.5fixed in 6.7.12026-02-20
vulnerable: 1.0 ... 6.7.0 (89 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of …
- CVE-2026-27025MEDIUMCVSS 5.5EG 5.5fixed in 6.7.12026-02-20
vulnerable: 1.0 ... 6.7.0 (89 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a fon…
- CVE-2026-27026MEDIUMCVSS 5.5EG 5.5fixed in 6.7.12026-02-20
vulnerable: 1.0 ... 6.7.0 (89 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompress…
- CVE-2026-27628HIGHCVSS 7.5EG 7.5fixed in 6.7.22026-02-25
vulnerable: 1.0 ... 6.7.1 (90 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a work…
- CVE-2026-27888HIGHCVSS 7.5EG 7.5fixed in 6.7.32026-02-26
vulnerable: 1.0 ... 6.7.2 (91 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and t…
- CVE-2026-28351MEDIUMCVSS 5.3EG 5.3fixed in 6.7.42026-02-27
vulnerable: 1.0 ... 6.7.3 (92 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode …
- CVE-2026-28804MEDIUMCVSS 5.3EG 5.3fixed in 6.7.52026-03-06
vulnerable: 1.0 ... 6.7.4 (93 versions)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. …
- CVE-2026-31826MEDIUMCVSS 5.5EG 5.5fixed in 6.8.02026-03-10
vulnerable: 1.0 ... 6.7.5 (94 versions)
pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, r…
- CVE-2026-33123MEDIUMCVSS 6.5EG 6.5fixed in 6.9.12026-03-20
vulnerable: 1.0 ... 6.9.0 (96 versions)
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with …
- CVE-2026-33699HIGHCVSS 7.5EG 7.5fixed in 6.9.22026-03-26
vulnerable: 1.0 ... 6.9.1 (97 versions)
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixe…
- CVE-2026-40260MEDIUMCVSS 5.3EG 5.3fixed in 6.10.02026-04-17
vulnerable: 1.0 ... 6.9.2 (98 versions)
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usa…
- CVE-2026-41168MEDIUMCVSS 5.3EG 5.3fixed in 6.10.12026-04-22
vulnerable: 1.0 ... 6.9.2 (99 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` …
- CVE-2026-41312MEDIUMCVSS 6.5EG 6.5fixed in 6.10.22026-04-22
vulnerable: 1.0 ... 6.9.2 (100 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/F…
- CVE-2026-41313MEDIUMCVSS 6.5EG 6.5fixed in 6.10.22026-04-22
vulnerable: 1.0 ... 6.9.2 (100 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value …
- CVE-2026-41314MEDIUMCVSS 6.5EG 6.5fixed in 6.10.22026-04-22
vulnerable: 1.0 ... 6.9.2 (100 versions)
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode`…
Check whether pypdf is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for pypdf CVEs against the assets you own.
Book a Demo →