Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pypdf

69 known vulnerabilities (20 high, 45 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
7.0.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release
7.0.0 (Nov 6, 2026), the latest release
Advisories
69 · 20 high, 45 medium, 4 low
Weekly downloads
45.5M
Dependents
3,141
Releases
124 since 1.4.0 (May 17, 2014)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 69 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 69

  • pypdf: Possible large memory usage when parsing cross-reference streams

    Affected: fixed in 6.21.3.

    Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes/large memory usage for encrypted PDF files

    Affected: fixed in 6.21.3.

    Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage for exceptions in strict mode

    Affected: fixed in 6.21.3.

    Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes when retrieving page labels

    Affected: fixed in 6.21.3.

    Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible infinite loop when cloning dictionaries

    Affected: fixed in 6.21.4.

    Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage when parsing page tree

    Affected: fixed in 6.21.4.

    Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search

    Affected: fixed in 6.21.4.

    Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

    Affected: fixed in 6.21.2.

    Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes for large xref table header limits

    Affected: fixed in 6.21.2.

    Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes for repeated references to the same missing object

    Affected: fixed in 6.21.2.

    Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113795Medium 6.0

    pypdf: Possible large memory usage for streams with multiple filters

    Affected: fixed in 6.20.0.

    Fixed in 6.20.0 (released Oct 9, 2026, 12 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113794Medium 6.0

    pypdf: Possible infinite loop when hitting EOF in standard xref table

    Affected: fixed in 6.20.0.

    Fixed in 6.20.0 (released Oct 9, 2026, 12 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113793Medium 6.0

    pypdf: Possible infinite loop when removing tree items

    Affected: fixed in 6.20.1.

    Fixed in 6.20.1 (released Oct 12, 2026, 9 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113792Medium 6.0

    pypdf: Possible infinite loop in PdfWriter.find_outline_item

    Affected: fixed in 6.20.1.

    Fixed in 6.20.1 (released Oct 12, 2026, 9 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113791Medium 6.0

    pypdf: Possible large memory usage when parsing content streams

    Affected: fixed in 6.21.0.

    Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).

    The latest release, 7.0.0, is not affected.

Show all 69 advisoriesShow fewer advisories
  • CVE-2026-113790Medium 6.0

    pypdf: Possible large memory usage when parsing arrays and dictionaries

    Affected: fixed in 6.21.0.

    Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-113789Medium 6.0

    pypdf: Possible long runtimes/large memory usage when retrieving form fields

    Affected: fixed in 6.21.0.

    Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Unvalidated JPEG image data loading

    Affected: fixed in 6.21.1.

    Fixed in 6.21.1 (released Oct 17, 2026, 4 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage when retrieving alphabetical page labels

    Affected: fixed in 6.19.0.

    Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes with large amount of embedded files

    Affected: fixed in 6.19.0.

    Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes when generating appearance streams

    Affected: fixed in 6.19.0.

    Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

    Affected: fixed in 6.18.1.

    Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage when parsing font data

    Affected: fixed in 6.18.1.

    Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

    Affected: fixed in 6.18.1.

    Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible long runtimes/large memory usage when parsing indirect objects

    Affected: fixed in 6.18.0.

    Fixed in 6.18.0 (released Sep 7, 2026, 23 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible large memory usage when retrieving Roman page labels

    Affected: fixed in 6.17.0.

    Fixed in 6.17.0 (released Sep 4, 2026, 26 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-84311Medium 4.8

    pypdf: Possible long runtimes/large memory usage when extracting XForm objects

    Affected: fixed in 6.16.1.

    Fixed in 6.16.1 (released Aug 14, 2026, 18 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-84310Medium 4.8

    pypdf: Possible long runtimes/large memory usage when retrieving outlines

    Affected: fixed in 6.16.1.

    Fixed in 6.16.1 (released Aug 14, 2026, 18 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-84309Medium 6.9

    pypdf: Possible infinite loop for TreeObject.insert_child

    Affected: fixed in 6.16.0.

    Fixed in 6.16.0 (released Aug 13, 2026, 19 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-82398Medium 6.9

    pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

    Affected: fixed in 6.15.0.

    Fixed in 6.15.0 (released Aug 6, 2026, 25 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-71870Medium 4.8

    pypdf: Possible large memory usage for large /ToUnicode streams

    Affected: fixed in 6.15.0.

    Fixed in 6.15.0 (released Aug 6, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-71852Medium 4.8

    pypdf: Possible long runtimes/large memory usage for large CID font width ranges

    Affected: fixed in 6.15.0.

    Fixed in 6.15.0 (released Aug 6, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible infinite loop for not terminated inline images

    Affected: fixed in 6.14.1.

    Fixed in 6.14.1 (released Jun 23, 2026, 15 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

    Affected: fixed in 6.14.2.

    Fixed in 6.14.2 (released Jun 23, 2026, 15 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-59937Medium 6.9

    pypdf: Possible long runtimes for repeated malformed cross-reference entries

    Affected: fixed in 6.14.0.

    Fixed in 6.14.0 (released Jun 22, 2026, 16 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-59938Medium 6.9

    pypdf: Possible large memory usage for wrong image dimensions

    Affected: fixed in 6.14.0.

    Fixed in 6.14.0 (released Jun 22, 2026, 16 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-57204Medium 6.9

    pypdf: Missing stream length values ignore defined limits

    Affected: fixed in 6.13.3.

    Fixed in 6.13.3 (released Jun 17, 2026, 13 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-54651Medium 6.9

    pypdf: Possible infinite loop when processing threads/articles in writer

    Affected: fixed in 6.13.1.

    Fixed in 6.13.1 (released Jun 8, 2026, 14 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-49460Medium 5.1

    pypdf: Inefficient decoding of FlateDecode PNG predictor streams

    Affected: fixed in 6.12.2.

    Fixed in 6.12.2 (released May 26, 2026, 27 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-49461Medium 6.9

    pypdf: Possible large memory usage for form XObjects during text extraction

    Affected: fixed in 6.12.2.

    Fixed in 6.12.2 (released May 26, 2026, 27 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-54531Medium 6.9

    pypdf: Possible infinite loop when processing outlines/bookmarks in writer

    Affected: fixed in 6.13.0.

    Fixed in 6.13.0 (released Jun 5, 2026, 17 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-54530Medium 6.9

    pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

    Affected: fixed in 6.13.0.

    Fixed in 6.13.0 (released Jun 5, 2026, 17 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-48155Medium 4.8

    pypdf: Possible large memory usage for large offsets for layout mode text

    Affected: fixed in 6.12.0.

    Fixed in 6.12.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-48156Medium 5.1

    pypdf: Possible long runtimes for zero-only width values in cross-reference streams

    Affected: fixed in 6.12.0.

    Fixed in 6.12.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-48735Medium 6.9

    pypdf: Manipulated XMP metadata streams can exhaust RAM

    Affected: fixed in 6.12.1.

    Fixed in 6.12.1 (released May 22, 2026, 6 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41314Medium 4.8

    pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

    Affected: fixed in 6.10.2.

    Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41313Medium 4.8

    pypdf: Possible long runtimes for wrong size values in incremental mode

    Affected: fixed in 6.10.2.

    Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41312Medium 4.8

    pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

    Affected: fixed in 6.10.2.

    Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41168Medium 6.9

    pypdf has possible long runtimes for wrong size values in cross-reference and object streams

    Affected: fixed in 6.10.1.

    Fixed in 6.10.1 (released Apr 14, 2026, 8 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-40260Medium 6.9

    pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

    Affected: fixed in 6.10.0.

    Fixed in 6.10.0 (released Apr 10, 2026, 6 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-33699Medium 4.6

    pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

    Affected: fixed in 6.9.2.

    Fixed in 6.9.2 (released Mar 23, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-33123Medium 5.1

    pypdf has inefficient decoding of array-based streams

    Affected: fixed in 6.9.1.

    Fixed in 6.9.1 (released Mar 17, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-31826Medium 6.8

    pypdf: manipulated stream length values can exhaust RAM

    Affected: fixed in 6.8.0.

    Fixed in 6.8.0 (released Mar 9, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-28804Medium 6.9

    pypdf: Inefficient decoding of ASCIIHexDecode streams

    Affected: fixed in 6.7.5.

    Fixed in 6.7.5 (released Mar 2, 2026, 4 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-28351Medium 6.9

    Manipulated RunLengthDecode streams can exhaust RAM

    Affected: fixed in 6.7.4.

    Fixed in 6.7.4 (released Feb 27, 2026, the day of disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-27888Medium 6.6

    pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

    Affected: fixed in 6.7.3.

    Fixed in 6.7.3 (released Feb 24, 2026, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

    Affected: fixed in 6.7.2.

    Fixed in 6.7.2 (released Feb 22, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-27026Medium 6.9

    pypdf possibly has long runtimes for malformed FlateDecode streams

    Affected: fixed in 6.7.1.

    Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-27025Medium 6.9

    pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

    Affected: fixed in 6.7.1.

    Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-27024Medium 6.9

    pypdf has a possible infinite loop when processing TreeObject

    Affected: fixed in 6.7.1.

    Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-24688Medium 5.1

    pypdf has possible Infinite Loop when processing outlines/bookmarks

    Affected: fixed in 6.6.2.

    Fixed in 6.6.2 (released Jan 26, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf has possible long runtimes for malformed startxref

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • pypdf has possible long runtimes for missing /Root object with large /Size values

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2025-66019Medium 6.6

    pypdf manipulated LZWDecode streams can exhaust RAM

    Affected: fixed in 6.4.0.

    Fixed in 6.4.0 (released Nov 23, 2025, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2025-62708Medium 6.6

    pypdf manipulated LZWDecode streams can exhaust RAM

    Affected: fixed in 6.1.3.

    Fixed in 6.1.3 (released Oct 22, 2025, the day of disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2025-62707Medium 6.6

    pypdf affected by possible infinite loop when reading DCT inline images without EOF marker

    Affected: fixed in 6.1.3.

    Fixed in 6.1.3 (released Oct 22, 2025, the day of disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2025-55197Medium 6.6

    pypdf's Manipulated FlateDecode streams can exhaust RAM

    Affected: fixed in 6.0.0.

    Fixed in 6.0.0 (released Aug 11, 2025, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2023-46250Medium 5.1

    pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

    Affected: from 3.7.0, fixed in 3.17.0.

    Fixed in 3.17.0 (released Oct 29, 2023, 2 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2023-36464Medium 6.2

    Infinite Loop when a comment isn't followed by a character in pypdf

    Affected: from 3.1.0, fixed in 3.9.0.

    Fixed in 3.9.0 (released May 21, 2023, 37 days before disclosure).

    The latest release, 7.0.0, is not affected.