Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
68 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a `trailer`. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4289.
Recommended action: Upgrade to 6.21.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4290.
Recommended action: Upgrade to 6.21.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a `DictionaryObject`. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4288.
Recommended action: Upgrade to 6.21.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4251.
Recommended action: Upgrade to 6.21.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4265.
Recommended action: Upgrade to 6.21.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong `/Count` value. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4270.
Recommended action: Upgrade to 6.21.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4269.
Recommended action: Upgrade to 6.21.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4240.
Recommended action: Upgrade to 6.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4240. Notes This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.
Recommended action: Upgrade to 6.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4239.
Recommended action: Upgrade to 6.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4219.
Recommended action: Upgrade to 6.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4218.
Recommended action: Upgrade to 6.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4218.
Recommended action: Upgrade to 6.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data). Users which do not have the optional Pillow dependency installed in their environment are not affected. Patches This has been fixed in pypdf==6.21.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4222.
Recommended action: Upgrade to 6.21.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling findoutlineitem on a PdfWriter. Patches This has been fixed in pypdf==6.20.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4188.
Recommended action: Upgrade to 6.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. Patches This has been fixed in pypdf==6.20.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4188.
Recommended action: Upgrade to 6.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. Patches This has been fixed in pypdf==6.20.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4170. Notes This has been reported through both the secure channel and as a public issue at #4169.
Recommended action: Upgrade to 6.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. Patches This has been fixed in pypdf==6.20.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4173.
Recommended action: Upgrade to 6.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4081.
Recommended action: Upgrade to 6.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4087.
Recommended action: Upgrade to 6.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4096.
Recommended action: Upgrade to 6.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed /FlateDecode stream, where the byte-by-byte decompression is used. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4073.
Recommended action: Upgrade to 6.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4072.
Recommended action: Upgrade to 6.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4071.
Recommended action: Upgrade to 6.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR #4055.
Recommended action: Upgrade to 6.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.