# cve.now: Py-pdf

The newest entries naming Py-pdf as an affected vendor (up to 200), of 74 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119209](https://cve.now/CVE-2026-119209.md): pypdf: Possible large memory usage when parsing cross-reference streams (CVSS 7.1)
- [CVE-2026-119208](https://cve.now/CVE-2026-119208.md): pypdf: Possible long runtimes/large memory usage for encrypted PDF files (CVSS 7.1)
- [CVE-2026-119207](https://cve.now/CVE-2026-119207.md): pypdf: Possible large memory usage for exceptions in strict mode (CVSS 7.1)
- [CVE-2026-119206](https://cve.now/CVE-2026-119206.md): pypdf: Possible long runtimes when retrieving page labels (CVSS 7.1)
- [CVE-2026-119205](https://cve.now/CVE-2026-119205.md): pypdf: Possible infinite loop when cloning dictionaries (CVSS 7.1)
- [CVE-2026-119204](https://cve.now/CVE-2026-119204.md): pypdf: Possible large memory usage when parsing page tree (CVSS 7.1)
- [CVE-2026-119203](https://cve.now/CVE-2026-119203.md): pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search (CVSS 7.1)
- [CVE-2026-115585](https://cve.now/CVE-2026-115585.md): pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1)
- [CVE-2026-115580](https://cve.now/CVE-2026-115580.md): pypdf: Possible long runtimes for large xref table header limits (CVSS 7.1)
- [CVE-2026-115572](https://cve.now/CVE-2026-115572.md): pypdf: Possible long runtimes for repeated references to the same missing object (CVSS 7.1)
- [CVE-2026-114610](https://cve.now/CVE-2026-114610.md): fpdf2: Exponential SVG '\<use\>' expansion causes CPU and memory exhaustion in 'FPDF.image()' (CVSS 6.5)
- [CVE-2026-114609](https://cve.now/CVE-2026-114609.md): fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content (CVSS 5.8)
- [CVE-2026-113795](https://cve.now/CVE-2026-113795.md): pypdf: Possible large memory usage for streams with multiple filters (CVSS 6.0)
- [CVE-2026-113794](https://cve.now/CVE-2026-113794.md): pypdf: Possible infinite loop when hitting EOF in standard xref table (CVSS 6.0)
- [CVE-2026-113793](https://cve.now/CVE-2026-113793.md): pypdf: Possible infinite loop when removing tree items (CVSS 6.0)
- [CVE-2026-113792](https://cve.now/CVE-2026-113792.md): pypdf: Possible infinite loop in PdfWriter.find\_outline\_item (CVSS 6.0)
- [CVE-2026-113791](https://cve.now/CVE-2026-113791.md): pypdf: Possible large memory usage when parsing content streams (CVSS 6.0)
- [CVE-2026-113790](https://cve.now/CVE-2026-113790.md): pypdf: Possible large memory usage when parsing arrays and dictionaries (CVSS 6.0)
- [CVE-2026-113789](https://cve.now/CVE-2026-113789.md): pypdf: Possible long runtimes/large memory usage when retrieving form fields (CVSS 6.0)
- [CVE-2026-113786](https://cve.now/CVE-2026-113786.md): pypdf: Unvalidated JPEG image data loading (CVSS 2.3)
- [CVE-2026-103000](https://cve.now/CVE-2026-103000.md): pypdf: Possible large memory usage when retrieving alphabetical page labels (CVSS 8.7)
- [CVE-2026-102999](https://cve.now/CVE-2026-102999.md): pypdf: Possible long runtimes with large amount of embedded files (CVSS 8.7)
- [CVE-2026-102998](https://cve.now/CVE-2026-102998.md): pypdf: Possible long runtimes when generating appearance streams (CVSS 8.7)
- [CVE-2026-102997](https://cve.now/CVE-2026-102997.md): pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) (CVSS 8.7)
- [CVE-2026-102996](https://cve.now/CVE-2026-102996.md): pypdf: Possible large memory usage when parsing font data (CVSS 8.7)
- [CVE-2026-102995](https://cve.now/CVE-2026-102995.md): pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) (CVSS 8.7)
- [CVE-2026-102994](https://cve.now/CVE-2026-102994.md): pypdf: Possible long runtimes/large memory usage when parsing indirect objects (CVSS 8.7)
- [CVE-2026-102993](https://cve.now/CVE-2026-102993.md): pypdf: Possible large memory usage when retrieving Roman page labels (CVSS 8.7)
- [CVE-2026-84311](https://cve.now/CVE-2026-84311.md): pypdf: Possible long runtimes/large memory usage when extracting XForm objects (CVSS 4.8)
- [CVE-2026-84310](https://cve.now/CVE-2026-84310.md): pypdf: Possible long runtimes/large memory usage when retrieving outlines (CVSS 4.8)
- [CVE-2026-84309](https://cve.now/CVE-2026-84309.md): pypdf: Possible infinite loop for TreeObject.insert\_child (CVSS 6.9)
- [CVE-2026-82398](https://cve.now/CVE-2026-82398.md): pypdf: Inefficient handling of non-whitespace inputs in read\_until\_whitespace (CVSS 6.9)
- [CVE-2026-71870](https://cve.now/CVE-2026-71870.md): pypdf: Possible large memory usage for large /ToUnicode streams (CVSS 4.8)
- [CVE-2026-71852](https://cve.now/CVE-2026-71852.md): pypdf: Possible long runtimes/large memory usage for large CID font width ranges (CVSS 4.8)
- [CVE-2026-59936](https://cve.now/CVE-2026-59936.md): pypdf: Possible infinite loop for not terminated inline images (CVSS 8.7)
- [CVE-2026-59935](https://cve.now/CVE-2026-59935.md): pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) (CVSS 8.7)
- [CVE-2026-59937](https://cve.now/CVE-2026-59937.md): pypdf: Possible long runtimes for repeated malformed cross-reference entries (CVSS 6.9)
- [CVE-2026-59938](https://cve.now/CVE-2026-59938.md): pypdf: Possible large memory usage for wrong image dimensions (CVSS 6.9)
- [CVE-2026-57204](https://cve.now/CVE-2026-57204.md): pypdf: Missing stream length values ignore defined limits (CVSS 6.9)
- [CVE-2026-54651](https://cve.now/CVE-2026-54651.md): pypdf: Possible infinite loop when processing threads/articles in writer (CVSS 6.9)
- [CVE-2026-49460](https://cve.now/CVE-2026-49460.md): pypdf: Inefficient decoding of FlateDecode PNG predictor streams (CVSS 5.1)
- [CVE-2026-49461](https://cve.now/CVE-2026-49461.md): pypdf: Possible large memory usage for form XObjects during text extraction (CVSS 6.9)
- [CVE-2026-54531](https://cve.now/CVE-2026-54531.md): pypdf: Possible infinite loop when processing outlines/bookmarks in writer (CVSS 6.9)
- [CVE-2026-54530](https://cve.now/CVE-2026-54530.md): pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction (CVSS 6.9)
- [CVE-2026-48155](https://cve.now/CVE-2026-48155.md): pypdf: Possible large memory usage for large offsets for layout mode text (CVSS 4.8)
- [CVE-2026-48156](https://cve.now/CVE-2026-48156.md): pypdf: Possible long runtimes for zero-only width values in cross-reference streams (CVSS 5.1)
- [CVE-2026-48735](https://cve.now/CVE-2026-48735.md): pypdf: Manipulated XMP metadata streams can exhaust RAM (CVSS 6.9)
- [CVE-2026-41314](https://cve.now/CVE-2026-41314.md): pypdf: Manipulated FlateDecode image dimensions can exhaust RAM (CVSS 4.8)
- [CVE-2026-41313](https://cve.now/CVE-2026-41313.md): pypdf: Possible long runtimes for wrong size values in incremental mode (CVSS 4.8)
- [CVE-2026-41312](https://cve.now/CVE-2026-41312.md): pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM (CVSS 4.8)
- [CVE-2026-41168](https://cve.now/CVE-2026-41168.md): pypdf has possible long runtimes for wrong size values in cross-reference and object streams (CVSS 6.9)
- [CVE-2026-40260](https://cve.now/CVE-2026-40260.md): pypdf: Manipulated XMP metadata entity declarations can exhaust RAM (CVSS 6.9)
- [CVE-2026-33699](https://cve.now/CVE-2026-33699.md): pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read\_from\_stream (CVSS 4.6)
- [CVE-2026-33123](https://cve.now/CVE-2026-33123.md): pypdf has inefficient decoding of array-based streams (CVSS 5.1)
- [CVE-2026-31826](https://cve.now/CVE-2026-31826.md): pypdf: manipulated stream length values can exhaust RAM (CVSS 6.8)
- [CVE-2026-28804](https://cve.now/CVE-2026-28804.md): pypdf: Inefficient decoding of ASCIIHexDecode streams (CVSS 6.9)
- [CVE-2026-28351](https://cve.now/CVE-2026-28351.md): Manipulated RunLengthDecode streams can exhaust RAM (CVSS 6.9)
- [CVE-2026-27888](https://cve.now/CVE-2026-27888.md): pypdf: Manipulated FlateDecode XFA streams can exhaust RAM (CVSS 6.6)
- [CVE-2026-27628](https://cve.now/CVE-2026-27628.md): pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams (CVSS 1.2)
- [CVE-2026-27026](https://cve.now/CVE-2026-27026.md): pypdf possibly has long runtimes for malformed FlateDecode streams (CVSS 6.9)
- [CVE-2026-27025](https://cve.now/CVE-2026-27025.md): pypdf has possible long runtimes/large memory usage for large /ToUnicode streams (CVSS 6.9)
- [CVE-2026-27024](https://cve.now/CVE-2026-27024.md): pypdf has a possible infinite loop when processing TreeObject (CVSS 6.9)
- [CVE-2026-24688](https://cve.now/CVE-2026-24688.md): pypdf has possible Infinite Loop when processing outlines/bookmarks (CVSS 5.1)
- [CVE-2026-22691](https://cve.now/CVE-2026-22691.md): pypdf has possible long runtimes for malformed startxref (CVSS 2.7)
- [CVE-2026-22690](https://cve.now/CVE-2026-22690.md): pypdf has possible long runtimes for missing /Root object with large /Size values (CVSS 2.7)
- [CVE-2025-66019](https://cve.now/CVE-2025-66019.md): pypdf manipulated LZWDecode streams can exhaust RAM (CVSS 6.6)
- [CVE-2025-62708](https://cve.now/CVE-2025-62708.md): pypdf manipulated LZWDecode streams can exhaust RAM (CVSS 6.6)
- [CVE-2025-62707](https://cve.now/CVE-2025-62707.md): pypdf affected by possible infinite loop when reading DCT inline images without EOF marker (CVSS 6.6)
- [CVE-2025-55197](https://cve.now/CVE-2025-55197.md): pypdf's Manipulated FlateDecode streams can exhaust RAM (CVSS 6.6)
- [CVE-2023-46250](https://cve.now/CVE-2023-46250.md): pypdf possible Infinite Loop when PdfWriter(clone\_from) is used with a PDF (CVSS 5.1)
- [CVE-2023-36810](https://cve.now/CVE-2023-36810.md): Quadratic runtime with malformed PDF missing xref marker in pypdf (CVSS 6.2)
- [CVE-2023-36807](https://cve.now/CVE-2023-36807.md): Infinite Loop when reading malformed objects in pypdf (CVSS 6.2)
- [CVE-2023-36464](https://cve.now/CVE-2023-36464.md): Infinite Loop when a comment isn't followed by a character in pypdf (CVSS 6.2)
- [CVE-2022-24859](https://cve.now/CVE-2022-24859.md): Manipulated inline images can cause Infinite Loop in PyPDF2 (CVSS 6.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/py-pdf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.