Py-pdf vulnerabilities
74 CVEs and advisories name Py-pdf as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-84309pypdf: Possible infinite loop for TreeObject.insert_child
- CVE-2026-82398pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
- CVE-2026-71870pypdf: Possible large memory usage for large /ToUnicode streams
- CVE-2026-71852pypdf: Possible long runtimes/large memory usage for large CID font width ranges
- CVE-2026-59936pypdf: Possible infinite loop for not terminated inline images
- CVE-2026-59935pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
- CVE-2026-59937pypdf: Possible long runtimes for repeated malformed cross-reference entries
- CVE-2026-59938pypdf: Possible large memory usage for wrong image dimensions
- CVE-2026-57204pypdf: Missing stream length values ignore defined limits
- CVE-2026-54651pypdf: Possible infinite loop when processing threads/articles in writer
- CVE-2026-49460pypdf: Inefficient decoding of FlateDecode PNG predictor streams
- CVE-2026-49461pypdf: Possible large memory usage for form XObjects during text extraction
- CVE-2026-54531pypdf: Possible infinite loop when processing outlines/bookmarks in writer
- CVE-2026-54530pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
- CVE-2026-48155pypdf: Possible large memory usage for large offsets for layout mode text
- CVE-2026-48156pypdf: Possible long runtimes for zero-only width values in cross-reference streams
- CVE-2026-48735pypdf: Manipulated XMP metadata streams can exhaust RAM
- CVE-2026-41314pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
- CVE-2026-41313pypdf: Possible long runtimes for wrong size values in incremental mode
- CVE-2026-41312pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
- CVE-2026-41168pypdf has possible long runtimes for wrong size values in cross-reference and object streams
- CVE-2026-40260pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
- CVE-2026-33699pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
- CVE-2026-33123pypdf has inefficient decoding of array-based streams
- CVE-2026-31826pypdf: manipulated stream length values can exhaust RAM
- CVE-2026-28804pypdf: Inefficient decoding of ASCIIHexDecode streams
- CVE-2026-28351Manipulated RunLengthDecode streams can exhaust RAM
- CVE-2026-27888pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
- CVE-2026-27628pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
- CVE-2026-27026pypdf possibly has long runtimes for malformed FlateDecode streams