| CVE-2026-119203 | ALTO | pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | 30/10/2026 |
| CVE-2026-119204 | ALTO | pypdf has possible large memory usage when parsing page tree | 30/10/2026 |
| CVE-2026-119205 | ALTO | pypdf has possible infinite loop when cloning dictionaries | 30/10/2026 |
| CVE-2026-119206 | ALTO | pypdf has possible long runtimes when retrieving page labels | 30/10/2026 |
| CVE-2026-119207 | ALTO | pypdf has possible large memory usage for exceptions in strict mode | 30/10/2026 |
| CVE-2026-119208 | ALTO | pypdf has possible long runtimes/large memory usage for encrypted PDF files | 30/10/2026 |
| CVE-2026-119209 | ALTO | pypdf has possible large memory usage when parsing cross-reference streams | 30/10/2026 |
| CVE-2026-115585 | ALTO7.1 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference | 23/10/2026 |
| CVE-2026-115580 | ALTO7.1 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2. | 23/10/2026 |
| CVE-2026-115572 | ALTO7.1 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6. | 23/10/2026 |
| CVE-2026-113795 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0. | 21/10/2026 |
| CVE-2026-113794 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0. | 21/10/2026 |
| CVE-2026-113793 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1. | 21/10/2026 |
| CVE-2026-113792 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1. | 21/10/2026 |
| CVE-2026-113791 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0. | 21/10/2026 |
| CVE-2026-113790 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0. | 21/10/2026 |
| CVE-2026-113789 | MEDIO6.0 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0. | 21/10/2026 |
| CVE-2026-113786 | BAJO2.3 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected | 21/10/2026 |
| CVE-2026-103000 | ALTO7.5 | pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and | 30/09/2026 |
| CVE-2026-102999 | ALTO7.5 | pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesse | 30/09/2026 |