# pypdf (PyPI) vulnerabilities

69 known vulnerabilities (20 high, 45 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 7.0.0 (Nov 6, 2026): no advisory affects it
- Newest unaffected release: 7.0.0 (Nov 6, 2026), the latest release
- Weekly downloads: 45.5M
- Dependents: 3,141
- Releases: 124 since 1.4.0 (May 17, 2014)
- Registry: https://pypi.org/project/pypdf/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-119209: 1.4.0 to 6.21.2 (6.21.3 is outside it)
- CVE-2026-119208: 1.4.0 to 6.21.2 (6.21.3 is outside it)
- CVE-2026-119207: 1.4.0 to 6.21.2 (6.21.3 is outside it)
- CVE-2026-119206: 1.4.0 to 6.21.2 (6.21.3 is outside it)
- CVE-2026-119205: 1.4.0 to 6.21.3 (6.21.4 is outside it)
- CVE-2026-119204: 1.4.0 to 6.21.3 (6.21.4 is outside it)
- CVE-2026-119203: 1.4.0 to 6.21.3 (6.21.4 is outside it)
- CVE-2026-115585: 1.4.0 to 6.21.1 (6.21.2 is outside it)
- CVE-2026-115580: 1.4.0 to 6.21.1 (6.21.2 is outside it)
- CVE-2026-115572: 1.4.0 to 6.21.1 (6.21.2 is outside it)
- CVE-2026-113795: 1.4.0 to 6.19.0 (6.20.0 is outside it)
- CVE-2026-113794: 1.4.0 to 6.19.0 (6.20.0 is outside it)
- CVE-2026-113793: 1.4.0 to 6.20.0 (6.20.1 is outside it)
- CVE-2026-113792: 1.4.0 to 6.20.0 (6.20.1 is outside it)
- CVE-2026-113791: 1.4.0 to 6.20.1 (6.21.0 is outside it)
- CVE-2026-113790: 1.4.0 to 6.20.1 (6.21.0 is outside it)
- CVE-2026-113789: 1.4.0 to 6.20.1 (6.21.0 is outside it)
- CVE-2026-113786: 1.4.0 to 6.21.0 (6.21.1 is outside it)
- CVE-2026-103000: 1.4.0 to 6.18.1 (6.19.0 is outside it)
- CVE-2026-102999: 1.4.0 to 6.18.1 (6.19.0 is outside it)
- CVE-2026-102998: 1.4.0 to 6.18.1 (6.19.0 is outside it)
- CVE-2026-102997: 1.4.0 to 6.18.0 (6.18.1 is outside it)
- CVE-2026-102996: 1.4.0 to 6.18.0 (6.18.1 is outside it)
- CVE-2026-102995: 1.4.0 to 6.18.0 (6.18.1 is outside it)
- CVE-2026-102994: 1.4.0 to 6.17.0 (6.18.0 is outside it)
- CVE-2026-102993: 1.4.0 to 6.16.2 (6.17.0 is outside it)
- CVE-2026-84311: 1.4.0 to 6.16.0 (6.16.1 is outside it)
- CVE-2026-84310: 1.4.0 to 6.16.0 (6.16.1 is outside it)
- CVE-2026-84309: 1.4.0 to 6.15.0 (6.16.0 is outside it)
- CVE-2026-82398: 1.4.0 to 6.14.2 (6.15.0 is outside it)
- CVE-2026-71870: 1.4.0 to 6.14.2 (6.15.0 is outside it)
- CVE-2026-71852: 1.4.0 to 6.14.2 (6.15.0 is outside it)
- CVE-2026-59936: 1.4.0 to 6.14.0 (6.14.1 is outside it)
- CVE-2026-59935: 1.4.0 to 6.14.1 (6.14.2 is outside it)
- CVE-2026-59937: 1.4.0 to 6.13.3 (6.14.0 is outside it)
- CVE-2026-59938: 1.4.0 to 6.13.3 (6.14.0 is outside it)
- CVE-2026-57204: 1.4.0 to 6.13.2 (6.13.3 is outside it)
- CVE-2026-54651: 1.4.0 to 6.13.0 (6.13.1 is outside it)
- CVE-2026-49460: 1.4.0 to 6.12.1 (6.12.2 is outside it)
- CVE-2026-49461: 1.4.0 to 6.12.1 (6.12.2 is outside it)
- CVE-2026-54531: 1.4.0 to 6.12.2 (6.13.0 is outside it)
- CVE-2026-54530: 1.4.0 to 6.12.2 (6.13.0 is outside it)
- CVE-2026-48155: 1.4.0 to 6.11.0 (6.12.0 is outside it)
- CVE-2026-48156: 1.4.0 to 6.11.0 (6.12.0 is outside it)
- CVE-2026-48735: 1.4.0 to 6.12.0 (6.12.1 is outside it)
- CVE-2026-41314: 1.4.0 to 6.10.1 (6.10.2 is outside it)
- CVE-2026-41313: 1.4.0 to 6.10.1 (6.10.2 is outside it)
- CVE-2026-41312: 1.4.0 to 6.10.1 (6.10.2 is outside it)
- CVE-2026-41168: 1.4.0 to 6.10.0 (6.10.1 is outside it)
- CVE-2026-40260: 1.4.0 to 6.9.2 (6.10.0 is outside it)
- CVE-2026-33699: 1.4.0 to 6.9.1 (6.9.2 is outside it)
- CVE-2026-33123: 1.4.0 to 6.9.0 (6.9.1 is outside it)
- CVE-2026-31826: 1.4.0 to 6.7.5 (6.8.0 is outside it)
- CVE-2026-28804: 1.4.0 to 6.7.4 (6.7.5 is outside it)
- CVE-2026-28351: 1.4.0 to 6.7.3 (6.7.4 is outside it)
- CVE-2026-27888: 1.4.0 to 6.7.2 (6.7.3 is outside it)
- CVE-2026-27628: 1.4.0 to 6.7.1 (6.7.2 is outside it)
- CVE-2026-27026: 1.4.0 to 6.7.0 (6.7.1 is outside it)
- CVE-2026-27025: 1.4.0 to 6.7.0 (6.7.1 is outside it)
- CVE-2026-27024: 1.4.0 to 6.7.0 (6.7.1 is outside it)
- CVE-2026-24688: 1.4.0 to 6.6.1 (6.6.2 is outside it)
- CVE-2026-22691: 1.4.0 to 6.5.0 (6.6.0 is outside it)
- CVE-2026-22690: 1.4.0 to 6.5.0 (6.6.0 is outside it)
- CVE-2025-66019: 1.4.0 to 6.3.0 (6.4.0 is outside it)
- CVE-2025-62708: 1.4.0 to 6.1.2 (6.1.3 is outside it)
- CVE-2025-62707: 1.4.0 to 6.1.2 (6.1.3 is outside it)
- CVE-2025-55197: 1.4.0 to 5.9.0 (6.0.0 is outside it)
- CVE-2023-46250: 3.7.0 to 3.16.4 (3.17.0 is outside it)
- CVE-2023-36464: 3.1.0 to 3.8.1 (3.9.0 is outside it)

## Advisories (69)

### [CVE-2026-119209](https://cve.now/CVE-2026-119209): pypdf: Possible large memory usage when parsing cross-reference streams

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.3.
- Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119208](https://cve.now/CVE-2026-119208): pypdf: Possible long runtimes/large memory usage for encrypted PDF files

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.3.
- Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119207](https://cve.now/CVE-2026-119207): pypdf: Possible large memory usage for exceptions in strict mode

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.3.
- Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119206](https://cve.now/CVE-2026-119206): pypdf: Possible long runtimes when retrieving page labels

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.3.
- Fixed in 6.21.3 (released Oct 27, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119205](https://cve.now/CVE-2026-119205): pypdf: Possible infinite loop when cloning dictionaries

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.4.
- Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119204](https://cve.now/CVE-2026-119204): pypdf: Possible large memory usage when parsing page tree

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.4.
- Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-119203](https://cve.now/CVE-2026-119203): pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search

- Severity: High 7.1
- Published: Oct 29, 2026
- Affected: fixed in 6.21.4.
- Fixed in 6.21.4 (released Oct 28, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-115585](https://cve.now/CVE-2026-115585): pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

- Severity: High 7.1
- Published: Oct 23, 2026
- Affected: fixed in 6.21.2.
- Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-115580](https://cve.now/CVE-2026-115580): pypdf: Possible long runtimes for large xref table header limits

- Severity: High 7.1
- Published: Oct 23, 2026
- Affected: fixed in 6.21.2.
- Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-115572](https://cve.now/CVE-2026-115572): pypdf: Possible long runtimes for repeated references to the same missing object

- Severity: High 7.1
- Published: Oct 23, 2026
- Affected: fixed in 6.21.2.
- Fixed in 6.21.2 (released Oct 21, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113795](https://cve.now/CVE-2026-113795): pypdf: Possible large memory usage for streams with multiple filters

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.20.0.
- Fixed in 6.20.0 (released Oct 9, 2026, 12 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113794](https://cve.now/CVE-2026-113794): pypdf: Possible infinite loop when hitting EOF in standard xref table

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.20.0.
- Fixed in 6.20.0 (released Oct 9, 2026, 12 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113793](https://cve.now/CVE-2026-113793): pypdf: Possible infinite loop when removing tree items

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.20.1.
- Fixed in 6.20.1 (released Oct 12, 2026, 9 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113792](https://cve.now/CVE-2026-113792): pypdf: Possible infinite loop in PdfWriter.find\_outline\_item

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.20.1.
- Fixed in 6.20.1 (released Oct 12, 2026, 9 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113791](https://cve.now/CVE-2026-113791): pypdf: Possible large memory usage when parsing content streams

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.21.0.
- Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113790](https://cve.now/CVE-2026-113790): pypdf: Possible large memory usage when parsing arrays and dictionaries

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.21.0.
- Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113789](https://cve.now/CVE-2026-113789): pypdf: Possible long runtimes/large memory usage when retrieving form fields

- Severity: Medium 6.0
- Published: Oct 21, 2026
- Affected: fixed in 6.21.0.
- Fixed in 6.21.0 (released Oct 16, 2026, 5 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-113786](https://cve.now/CVE-2026-113786): pypdf: Unvalidated JPEG image data loading

- Severity: Low 2.3
- Published: Oct 21, 2026
- Affected: fixed in 6.21.1.
- Fixed in 6.21.1 (released Oct 17, 2026, 4 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-103000](https://cve.now/CVE-2026-103000): pypdf: Possible large memory usage when retrieving alphabetical page labels

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.19.0.
- Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102999](https://cve.now/CVE-2026-102999): pypdf: Possible long runtimes with large amount of embedded files

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.19.0.
- Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102998](https://cve.now/CVE-2026-102998): pypdf: Possible long runtimes when generating appearance streams

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.19.0.
- Fixed in 6.19.0 (released Sep 16, 2026, 14 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102997](https://cve.now/CVE-2026-102997): pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.18.1.
- Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102996](https://cve.now/CVE-2026-102996): pypdf: Possible large memory usage when parsing font data

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.18.1.
- Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102995](https://cve.now/CVE-2026-102995): pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.18.1.
- Fixed in 6.18.1 (released Sep 11, 2026, 19 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102994](https://cve.now/CVE-2026-102994): pypdf: Possible long runtimes/large memory usage when parsing indirect objects

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.18.0.
- Fixed in 6.18.0 (released Sep 7, 2026, 23 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-102993](https://cve.now/CVE-2026-102993): pypdf: Possible large memory usage when retrieving Roman page labels

- Severity: High 8.7
- Published: Sep 30, 2026
- Affected: fixed in 6.17.0.
- Fixed in 6.17.0 (released Sep 4, 2026, 26 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-84311](https://cve.now/CVE-2026-84311): pypdf: Possible long runtimes/large memory usage when extracting XForm objects

- Severity: Medium 4.8
- Published: Sep 1, 2026
- Affected: fixed in 6.16.1.
- Fixed in 6.16.1 (released Aug 14, 2026, 18 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-84310](https://cve.now/CVE-2026-84310): pypdf: Possible long runtimes/large memory usage when retrieving outlines

- Severity: Medium 4.8
- Published: Sep 1, 2026
- Affected: fixed in 6.16.1.
- Fixed in 6.16.1 (released Aug 14, 2026, 18 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-84309](https://cve.now/CVE-2026-84309): pypdf: Possible infinite loop for TreeObject.insert\_child

- Severity: Medium 6.9
- Published: Sep 1, 2026
- Affected: fixed in 6.16.0.
- Fixed in 6.16.0 (released Aug 13, 2026, 19 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-82398](https://cve.now/CVE-2026-82398): pypdf: Inefficient handling of non-whitespace inputs in read\_until\_whitespace

- Severity: Medium 6.9
- Published: Aug 31, 2026
- Affected: fixed in 6.15.0.
- Fixed in 6.15.0 (released Aug 6, 2026, 25 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-71870](https://cve.now/CVE-2026-71870): pypdf: Possible large memory usage for large /ToUnicode streams

- Severity: Medium 4.8
- Published: Aug 7, 2026
- Affected: fixed in 6.15.0.
- Fixed in 6.15.0 (released Aug 6, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-71852](https://cve.now/CVE-2026-71852): pypdf: Possible long runtimes/large memory usage for large CID font width ranges

- Severity: Medium 4.8
- Published: Aug 7, 2026
- Affected: fixed in 6.15.0.
- Fixed in 6.15.0 (released Aug 6, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-59936](https://cve.now/CVE-2026-59936): pypdf: Possible infinite loop for not terminated inline images

- Severity: High 8.7
- Published: Jul 8, 2026
- Affected: fixed in 6.14.1.
- Fixed in 6.14.1 (released Jun 23, 2026, 15 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-59935](https://cve.now/CVE-2026-59935): pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

- Severity: High 8.7
- Published: Jul 8, 2026
- Affected: fixed in 6.14.2.
- Fixed in 6.14.2 (released Jun 23, 2026, 15 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-59937](https://cve.now/CVE-2026-59937): pypdf: Possible long runtimes for repeated malformed cross-reference entries

- Severity: Medium 6.9
- Published: Jul 8, 2026
- Affected: fixed in 6.14.0.
- Fixed in 6.14.0 (released Jun 22, 2026, 16 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-59938](https://cve.now/CVE-2026-59938): pypdf: Possible large memory usage for wrong image dimensions

- Severity: Medium 6.9
- Published: Jul 8, 2026
- Affected: fixed in 6.14.0.
- Fixed in 6.14.0 (released Jun 22, 2026, 16 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-57204](https://cve.now/CVE-2026-57204): pypdf: Missing stream length values ignore defined limits

- Severity: Medium 6.9
- Published: Jun 30, 2026
- Affected: fixed in 6.13.3.
- Fixed in 6.13.3 (released Jun 17, 2026, 13 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-54651](https://cve.now/CVE-2026-54651): pypdf: Possible infinite loop when processing threads/articles in writer

- Severity: Medium 6.9
- Published: Jun 22, 2026
- Affected: fixed in 6.13.1.
- Fixed in 6.13.1 (released Jun 8, 2026, 14 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-49460](https://cve.now/CVE-2026-49460): pypdf: Inefficient decoding of FlateDecode PNG predictor streams

- Severity: Medium 5.1
- Published: Jun 22, 2026
- Affected: fixed in 6.12.2.
- Fixed in 6.12.2 (released May 26, 2026, 27 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-49461](https://cve.now/CVE-2026-49461): pypdf: Possible large memory usage for form XObjects during text extraction

- Severity: Medium 6.9
- Published: Jun 22, 2026
- Affected: fixed in 6.12.2.
- Fixed in 6.12.2 (released May 26, 2026, 27 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-54531](https://cve.now/CVE-2026-54531): pypdf: Possible infinite loop when processing outlines/bookmarks in writer

- Severity: Medium 6.9
- Published: Jun 22, 2026
- Affected: fixed in 6.13.0.
- Fixed in 6.13.0 (released Jun 5, 2026, 17 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-54530](https://cve.now/CVE-2026-54530): pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

- Severity: Medium 6.9
- Published: Jun 22, 2026
- Affected: fixed in 6.13.0.
- Fixed in 6.13.0 (released Jun 5, 2026, 17 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-48155](https://cve.now/CVE-2026-48155): pypdf: Possible large memory usage for large offsets for layout mode text

- Severity: Medium 4.8
- Published: May 28, 2026
- Affected: fixed in 6.12.0.
- Fixed in 6.12.0 (released May 21, 2026, 7 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-48156](https://cve.now/CVE-2026-48156): pypdf: Possible long runtimes for zero-only width values in cross-reference streams

- Severity: Medium 5.1
- Published: May 28, 2026
- Affected: fixed in 6.12.0.
- Fixed in 6.12.0 (released May 21, 2026, 7 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-48735](https://cve.now/CVE-2026-48735): pypdf: Manipulated XMP metadata streams can exhaust RAM

- Severity: Medium 6.9
- Published: May 28, 2026
- Affected: fixed in 6.12.1.
- Fixed in 6.12.1 (released May 22, 2026, 6 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-41314](https://cve.now/CVE-2026-41314): pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

- Severity: Medium 4.8
- Published: Apr 22, 2026
- Affected: fixed in 6.10.2.
- Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-41313](https://cve.now/CVE-2026-41313): pypdf: Possible long runtimes for wrong size values in incremental mode

- Severity: Medium 4.8
- Published: Apr 22, 2026
- Affected: fixed in 6.10.2.
- Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-41312](https://cve.now/CVE-2026-41312): pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

- Severity: Medium 4.8
- Published: Apr 22, 2026
- Affected: fixed in 6.10.2.
- Fixed in 6.10.2 (released Apr 15, 2026, 7 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-41168](https://cve.now/CVE-2026-41168): pypdf has possible long runtimes for wrong size values in cross-reference and object streams

- Severity: Medium 6.9
- Published: Apr 22, 2026
- Affected: fixed in 6.10.1.
- Fixed in 6.10.1 (released Apr 14, 2026, 8 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-40260](https://cve.now/CVE-2026-40260): pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

- Severity: Medium 6.9
- Published: Apr 16, 2026
- Affected: fixed in 6.10.0.
- Fixed in 6.10.0 (released Apr 10, 2026, 6 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-33699](https://cve.now/CVE-2026-33699): pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read\_from\_stream

- Severity: Medium 4.6
- Published: Mar 26, 2026
- Affected: fixed in 6.9.2.
- Fixed in 6.9.2 (released Mar 23, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-33123](https://cve.now/CVE-2026-33123): pypdf has inefficient decoding of array-based streams

- Severity: Medium 5.1
- Published: Mar 20, 2026
- Affected: fixed in 6.9.1.
- Fixed in 6.9.1 (released Mar 17, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-31826](https://cve.now/CVE-2026-31826): pypdf: manipulated stream length values can exhaust RAM

- Severity: Medium 6.8
- Published: Mar 10, 2026
- Affected: fixed in 6.8.0.
- Fixed in 6.8.0 (released Mar 9, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-28804](https://cve.now/CVE-2026-28804): pypdf: Inefficient decoding of ASCIIHexDecode streams

- Severity: Medium 6.9
- Published: Mar 6, 2026
- Affected: fixed in 6.7.5.
- Fixed in 6.7.5 (released Mar 2, 2026, 4 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-28351](https://cve.now/CVE-2026-28351): Manipulated RunLengthDecode streams can exhaust RAM

- Severity: Medium 6.9
- Published: Feb 27, 2026
- Affected: fixed in 6.7.4.
- Fixed in 6.7.4 (released Feb 27, 2026, the day of disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-27888](https://cve.now/CVE-2026-27888): pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

- Severity: Medium 6.6
- Published: Feb 26, 2026
- Affected: fixed in 6.7.3.
- Fixed in 6.7.3 (released Feb 24, 2026, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-27628](https://cve.now/CVE-2026-27628): pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

- Severity: Low 1.2
- Published: Feb 25, 2026
- Affected: fixed in 6.7.2.
- Fixed in 6.7.2 (released Feb 22, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-27026](https://cve.now/CVE-2026-27026): pypdf possibly has long runtimes for malformed FlateDecode streams

- Severity: Medium 6.9
- Published: Feb 20, 2026
- Affected: fixed in 6.7.1.
- Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-27025](https://cve.now/CVE-2026-27025): pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

- Severity: Medium 6.9
- Published: Feb 20, 2026
- Affected: fixed in 6.7.1.
- Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-27024](https://cve.now/CVE-2026-27024): pypdf has a possible infinite loop when processing TreeObject

- Severity: Medium 6.9
- Published: Feb 20, 2026
- Affected: fixed in 6.7.1.
- Fixed in 6.7.1 (released Feb 17, 2026, 3 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-24688](https://cve.now/CVE-2026-24688): pypdf has possible Infinite Loop when processing outlines/bookmarks

- Severity: Medium 5.1
- Published: Jan 27, 2026
- Affected: fixed in 6.6.2.
- Fixed in 6.6.2 (released Jan 26, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-22691](https://cve.now/CVE-2026-22691): pypdf has possible long runtimes for malformed startxref

- Severity: Low 2.7
- Published: Jan 10, 2026
- Affected: fixed in 6.6.0.
- Fixed in 6.6.0 (released Jan 9, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2026-22690](https://cve.now/CVE-2026-22690): pypdf has possible long runtimes for missing /Root object with large /Size values

- Severity: Low 2.7
- Published: Jan 10, 2026
- Affected: fixed in 6.6.0.
- Fixed in 6.6.0 (released Jan 9, 2026, 1 day before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2025-66019](https://cve.now/CVE-2025-66019): pypdf manipulated LZWDecode streams can exhaust RAM

- Severity: Medium 6.6
- Published: Nov 25, 2025
- Affected: fixed in 6.4.0.
- Fixed in 6.4.0 (released Nov 23, 2025, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2025-62708](https://cve.now/CVE-2025-62708): pypdf manipulated LZWDecode streams can exhaust RAM

- Severity: Medium 6.6
- Published: Oct 22, 2025
- Affected: fixed in 6.1.3.
- Fixed in 6.1.3 (released Oct 22, 2025, the day of disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2025-62707](https://cve.now/CVE-2025-62707): pypdf affected by possible infinite loop when reading DCT inline images without EOF marker

- Severity: Medium 6.6
- Published: Oct 22, 2025
- Affected: fixed in 6.1.3.
- Fixed in 6.1.3 (released Oct 22, 2025, the day of disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2025-55197](https://cve.now/CVE-2025-55197): pypdf's Manipulated FlateDecode streams can exhaust RAM

- Severity: Medium 6.6
- Published: Aug 13, 2025
- Affected: fixed in 6.0.0.
- Fixed in 6.0.0 (released Aug 11, 2025, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2023-46250](https://cve.now/CVE-2023-46250): pypdf possible Infinite Loop when PdfWriter(clone\_from) is used with a PDF

- Severity: Medium 5.1
- Published: Oct 31, 2023
- Affected: from 3.7.0, fixed in 3.17.0.
- Fixed in 3.17.0 (released Oct 29, 2023, 2 days before disclosure).
- The latest release, 7.0.0, is not affected.

### [CVE-2023-36464](https://cve.now/CVE-2023-36464): Infinite Loop when a comment isn't followed by a character in pypdf

- Severity: Medium 6.2
- Published: Jun 27, 2023
- Affected: from 3.1.0, fixed in 3.9.0.
- Fixed in 3.9.0 (released May 21, 2023, 37 days before disclosure).
- The latest release, 7.0.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/pypdf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.