Vulnerabilities for pypdf

First version without a known vulnerability: 6.15.0

Details

• GHSA-fp3f-mc75-235c2026-08-07

  pypdf: Possible large memory usage for large /ToUnicode streams

  Fixed in: 6.15.0

• GHSA-fwg2-594c-jp422026-08-07

  pypdf: Possible long runtimes/large memory usage for large CID font width ranges

  Fixed in: 6.15.0

• GHSA-g867-7843-wf8q2026-07-23

  pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

  Fixed in: 6.14.2

• GHSA-5xf7-4p34-54qr2026-07-23

  pypdf: Possible infinite loop for not terminated inline images

  Fixed in: 6.14.1

• GHSA-55h5-xmcq-c37v2026-07-23

  pypdf: Possible long runtimes for repeated malformed cross-reference entries

  Fixed in: 6.14.0

• GHSA-5qjq-93h5-hrgp2026-07-23

  pypdf: Possible large memory usage for wrong image dimensions

  Fixed in: 6.14.0

• GHSA-g9xf-7f8q-9mcj2026-07-09

  pypdf: Possible infinite loop when processing threads/articles in writer

  Fixed in: 6.13.1

• GHSA-jm82-fx9c-mx942026-06-18

  pypdf: Missing stream length values ignore defined limits

  Fixed in: 6.13.3

• GHSA-m2v9-299j-rv962026-06-16

  pypdf: Possible infinite loop when processing outlines/bookmarks in writer

  Fixed in: 6.13.0

• GHSA-52x6-gq3r-vpf42026-06-16

  pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

  Fixed in: 6.13.0

• GHSA-j543-4vmf-qm7v2026-06-16

  pypdf: Possible large memory usage for form XObjects during text extraction

  Fixed in: 6.12.2

• GHSA-5hgr-hg42-57jg2026-06-16

  pypdf: Inefficient decoding of FlateDecode PNG predictor streams

  Fixed in: 6.12.2

• GHSA-wjqc-6w8f-h24c2026-06-16

  pypdf: Manipulated XMP metadata streams can exhaust RAM

  Fixed in: 6.12.1

• GHSA-248m-82v9-q6g62026-06-12

  pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

  Fixed in: 6.12.0

• GHSA-cj93-chg6-vgv82026-06-12

  pypdf: Possible large memory usage for large offsets for layout mode text

  Fixed in: 6.12.0

• GHSA-x284-j5p8-9c5p2026-04-16

  pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

  Fixed in: 6.10.2

• GHSA-4pxv-j86v-mhcw2026-04-16

  pypdf: Possible long runtimes for wrong size values in incremental mode

  Fixed in: 6.10.2

• GHSA-7gw9-cf7v-778f2026-04-16

  pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

  Fixed in: 6.10.2

• GHSA-jj6c-8h6c-hppx2026-04-15

  pypdf has long runtimes for wrong size values in cross-reference and object streams

  Fixed in: 6.10.1

• GHSA-3crg-w4f6-42mx2026-04-10

  pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

  Fixed in: 6.10.0

• GHSA-87mj-5ggw-8qc32026-03-25

  pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

  Fixed in: 6.9.2

• GHSA-qpxp-75px-xjcp2026-03-18

  pypdf has inefficient decoding of array-based streams

  Fixed in: 6.9.1

• GHSA-hqmh-ppp3-xvm72026-03-11

  pypdf: manipulated stream length values can exhaust RAM

  Fixed in: 6.8.0

• GHSA-9m86-7pmv-28522026-03-02

  pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

  Fixed in: 6.7.5

• GHSA-f2v5-7jq9-h8cg2026-02-28

  pypdf: Manipulated RunLengthDecode streams can exhaust RAM

  Fixed in: 6.7.4

• GHSA-x7hp-r3qg-r3cj2026-02-26

  pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

  Fixed in: 6.7.3

• GHSA-2rw7-x74f-jg352026-02-25

  pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

  Fixed in: 6.7.2

• GHSA-9mvc-8737-8j8h2026-02-18

  pypdf possibly has long runtimes for malformed FlateDecode streams

  Fixed in: 6.7.1

• GHSA-wgvp-vg3v-2xq32026-02-18

  pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

  Fixed in: 6.7.1

• GHSA-996q-pr4m-cvgq2026-02-18

  pypdf has a possible infinite loop when processing TreeObject

  Fixed in: 6.7.1

• GHSA-2q4j-m29v-hq732026-01-26

  pypdf has possible Infinite Loop when processing outlines/bookmarks

  Fixed in: 6.6.2

• GHSA-4f6g-68pf-7vhv2026-01-09

  pypdf has possible long runtimes for malformed startxref

  Fixed in: 6.6.0

• GHSA-4xc4-762w-m6cg2026-01-09

  pypdf has possible long runtimes for missing /Root object with large /Size values

  Fixed in: 6.6.0

• GHSA-m449-cwjh-6pw72025-11-24

  pypdf's LZWDecode streams be manipulated to exhaust RAM

  Fixed in: 6.4.0

• GHSA-jfx9-29x2-rv3j2025-10-22

  pypdf can exhaust RAM via manipulated LZWDecode streams

  Fixed in: 6.1.3

• GHSA-vr63-x8vc-m2652025-10-22

  pypdf possibly loops infinitely when reading DCT inline images without EOF marker

  Fixed in: 6.1.3

• GHSA-7hfw-26vp-jp8m2025-08-13

  PyPDF's Manipulated FlateDecode streams can exhaust RAM

  Fixed in: 6.0.0

• GHSA-wjcc-cq79-p63f2023-10-31

  Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

  Fixed in: 3.17.0

• GHSA-4vvm-4w3v-6mr82023-06-30

  pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

  Fixed in: 3.9.0