Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 7.1 | CVE-2026-115585 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-115585pypdf is a free and open-source pure-python PDF library
Executive summaryThis advisory is a code diff for pypdf, a open-source Python PDF library, and it shows performance-related changes to how the library reads PDF files. The advisory does not state a severity rating or describe a security impact, and it does not name a fixed release. Technical summaryThe diff changes pypdf's object lookup and cross-reference table recovery so that a new helper, get_stream_data, reads the whole stream instead of repeating the same code, and it adds a cache check keyed on object generation and number. The added tests measure speed for repeated invalid object lookups and for large cross-reference tables, which suggests the underlying issue is excessive processing time on crafted input. The advisory does not state the vulnerability class, attack vector, preconditions, affected versions, fixed versions, workarounds, or exploitation status, and it does not describe any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-115580 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-115580pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a flaw in pypdf, a free open-source Python library for reading PDF files. The text provided contains only a code diff and no severity rating, so the advisory does not state how serious the issue is or what the vendor recommends. Technical summaryThe diff changes how pypdf reads the size declared in a standard cross-reference table, adding a check that rejects a declared size larger than the stream length divided by 20 and raises LimitReachedError. The change suggests a resource-exhaustion or malformed-input issue, but the advisory does not explicitly state the vulnerability class, attack vector, or preconditions. Affected version ranges are not stated, and no fixed version number is stated. No workaround and no exploitation status are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/a3061e34…20f5f049c53cfb1482b2 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-115572 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-115572pypdf is a free and open-source pure-python PDF library
Executive summaryThis advisory shows source code changes to pypdf, a free open-source Python PDF library, that appear to address performance problems when repeatedly looking up invalid PDF objects and reading cross-reference tables. The advisory text does not state a severity rating or describe an exploitable security impact. It does not state any vendor recommendation or fixed version. Technical summaryThe advisory is a diff of commits to pypdf, with new tests named for speed and caching of repeated invalid object lookups and standard xref table reads. The changes add a get_stream_data helper in _utils.py, change the cache check in get_object in _reader.py, and rename a parameter in _doc_common.py. The advisory does not state a vulnerability class, CVSS score, attack vector, preconditions, affected versions, fixed versions, workarounds, or detection guidance. The tests reference earlier run times of about 25 seconds, which suggests a performance issue, but the advisory does not explicitly call it a security vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113795 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113795pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a change to pypdf, a free open-source Python library for reading PDF files, that adds limits on the number of filters and the accumulated decoding work per PDF stream. The advisory text does not state a severity rating, and it does not say whether the change fixes a vulnerability or which versions are affected. The text reads as a code diff rather than a vulnerability advisory, so defenders should check the original NVD entry for those details. Technical summaryThe diff adds a configurable maximum filter count (stream_filters_maximum_length, default 16) and a maximum accumulated decoding work per stream (stream_decoding_work_maximum_length, default 300_000_000 bytes) to pypdf/_configuration.py and pypdf/filters.py, raising LimitReachedError when either limit is exceeded. The added tests suggest the change guards against resource exhaustion from crafted PDF streams with many filters or large repeated decoding work. The advisory does not state a CVE description, vulnerability class, attack vector, affected versions, fixed version, CVSS score, workaround, or exploitation status. It also does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/80a84d4b…ccb0d2365400f3f0e185 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113794 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113794pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a fix in pypdf, a free open-source Python library for reading PDF files. It shows a code change that raises an error when the cross-reference table ends unexpectedly, but it does not state how serious the issue is or what the vendor recommends beyond this change. Technical summaryThe change adds a length check in _read_standard_xref_table in pypdf/_reader.py so that a short read raises PdfReadError with the message 'Unexpected EOF in Xref table.' This suggests the flaw involves handling of truncated or malformed PDF cross-reference tables, likely a crash or unhandled condition on end-of-file. The advisory does not state the vulnerability class, attack vector, or preconditions. Affected versions are not stated, fixed versions are not stated, and no CVSS score is stated. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/37e1cd68…9f7e1c614eee8d639c58 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113793 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113793pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a fix in pypdf, a free open-source pure-Python PDF library, for cyclic outline and tree hierarchies that could cause endless processing. The advisory text provided does not state a severity rating or a score. It also does not state the vendor's recommended version, so the fix version is not stated. Technical summaryThe changes in the diff add cycle detection to find_outline_item in pypdf/_writer.py and to remove_child and _remove_node_from_tree in pypdf/generic/_data_structures.py, raising LimitReachedError when a cyclic /Next or outline hierarchy is found. The new tests build crafted PDF object chains that loop through /Next or /First references. The advisory does not state a CVE vulnerability class explicitly, an attack vector, required user interaction, affected version ranges, fixed version numbers, workarounds, or exploitation status. Those details are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/c9c35b44…094f6c816e69d4ed25a0 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113792 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113792pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a fix in pypdf, a free open-source Python library for working with PDF files, for cyclic outline and linked-list hierarchies that could cause unbounded processing. The advisory text provided does not state a severity rating or a CVSS score. It does not state a recommended action beyond the code changes shown. Technical summaryThe changes add cycle detection to the outline lookup in PdfWriter.find_outline_item and to TreeObject._remove_node_from_tree and remove_child in pypdf/generic/_data_structures.py, raising LimitReachedError when a cyclic /Next or /First hierarchy is detected. The vulnerability class is not explicitly stated, though the change set indicates an unbounded recursion or loop issue on crafted PDF structures. The attack vector and preconditions are not stated beyond the test cases, which build cyclic structures in a writer. Affected and fixed version numbers are not stated in the advisory. Workarounds are not stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/c9c35b44…094f6c816e69d4ed25a0 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113791 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113791pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory is a code change to pypdf, a free open-source Python PDF library, and does not describe a vulnerability. It does not state how serious the issue is or what the vendor recommends. Defenders should check the upstream project for a published advisory before deciding on action. Technical summaryThe advisory contains only a source code diff for pypdf. The changes add configurable limits on array element counts, dictionary entry counts, and a per-content-stream parsing budget, and they make limit errors propagate instead of being swallowed. This suggests a resource-exhaustion hardening fix, but the advisory does not state the vulnerability class, attack vector, or preconditions. Affected versions, fixed versions, CVSS score, workarounds, exploitation status, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/18bd2981…9507602c58a63d6c9b12 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113790 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113790pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory is a diff of changes to pypdf, a pure-Python PDF library, that add limits on array and dictionary element counts and on parsing work for content streams. The advisory does not state a severity rating, an impact description, or a CVE-specific vulnerability description, and it does not state what the vendor recommends beyond the code changes shown. Defenders should check which pypdf version contains these changes before relying on them. Technical summaryThe advisory shows code changes that add configuration limits (array_maximum_element_count, dictionary_maximum_element_count, stream_parsing_work_maximum_count) and a shared StreamParsingBudget object to pypdf's object parser, apparently to bound resource consumption while parsing crafted PDF content. The vulnerability class, attack vector, and preconditions are not stated, and no CVSS score is given. Affected versions and fixed versions are not stated in the advisory text. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/18bd2981…9507602c58a63d6c9b12 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-113789 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113789pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory describes a change to the pypdf PDF library that adds limits on the number and nesting depth of interactive form fields, which is aimed at preventing excessive resource use when parsing crafted PDFs. The advisory text provided does not state a severity rating for the issue. The text shows a code change and tests but does not explicitly state the vendor's recommendation in plain terms. Technical summaryThe change appears to address unbounded traversal of PDF AcroForm field trees, where deeply nested or very large field structures could consume excessive time and resources. It adds configuration limits form_fields_maximum_entries (default 100_000) and form_fields_maximum_depth (default 100), replaces the stack parameter of get_fields with a visited-ID set, and deprecates the stack parameter for removal in 7.0.0. The advisory does not state the vulnerability class, the attack vector or preconditions in explicit terms, affected versions, fixed versions, workarounds, or exploitation status, and these are not stated. No CVSS score or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/5ef728f0…89f861ba0a67402fe3f2 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.3 | CVE-2026-113786 |
pypdf is a free and open-source pure-python PDF library
py-pdfpy-pdf pypdf
|
NVD | |||
|
CVE-2026-113786pypdf is a free and open-source pure-python PDF library
Executive summaryThe advisory concerns pypdf, a free open-source Python library for reading and processing PDF files. The provided text is a code diff showing a fix that restricts how DCT-encoded (JPEG) image data is opened, but it does not state a severity rating or a formal impact description. Technical summaryThe fix changes pypdf/generic/_image_xobject.py so that DCTDecode image data is opened with Pillow restricted to the JPEG format, rather than letting Pillow auto-detect any image plugin, and adds tests that other formats such as BMP, GIF, PNG and TIFF are rejected. The advisory text does not state the vulnerability class, CVE severity or CVSS score, attack vector, preconditions, affected version range, fixed version number, workaround, or detection guidance. These items are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/512d8eb9…0504e6da2dcef8679e07 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-103000 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-103000pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102999 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102999pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102998 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102998pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102997 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102997pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102996 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102996pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102995 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102995pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102994 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102994pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102993 |
pypdf is a free and open-source pure-python PDF library
py-pdf, Pypdf Projectpy-pdf pypdf, Pypdf Project Pypdf
|
NVD | |||
|
CVE-2026-102993pypdf is a free and open-source pure-python PDF library
From the advisorypypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||