pypdf vulnerabilities
CVEs whose affected-version data names the pypdf package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
53 CVEsRSS
CVE-2026-71870Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a fo…
CVE-2026-71852Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font…
CVE-2026-54651Mediumpypdf: Possible infinite loop when processing threads/articles in writer
pypdf: Possible infinite loop when processing threads/articles in writer
CVE-2026-57204Mediumpypdf: Missing stream length values ignore defined limits
pypdf: Missing stream length values ignore defined limits
GHSA-jm82-fx9c-mx94Mediumpypdf: Missing stream length values ignore defined limits
pypdf: Missing stream length values ignore defined limits
CVE-2026-49460Mediumpypdf: Inefficient decoding of FlateDecode PNG predictor streams
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
CVE-2026-49461Mediumpypdf: Possible large memory usage for form XObjects during text extraction
pypdf: Possible large memory usage for form XObjects during text extraction
CVE-2026-54530Mediumpypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
CVE-2026-54531Mediumpypdf: Possible infinite loop when processing outlines/bookmarks in writer
pypdf: Possible infinite loop when processing outlines/bookmarks in writer
CVE-2026-48155Medium· 5.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offset…
CVE-2026-48156Low· 3.3pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size …
CVE-2026-48735Medium· 5.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecess…
CVE-2026-41314Medium· 6.5pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
CVE-2026-41312Medium· 6.5pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
CVE-2026-41313Medium· 6.5pypdf: Possible long runtimes for wrong size values in incremental mode
pypdf: Possible long runtimes for wrong size values in incremental mode
CVE-2026-41168Medium· 5.3pypdf has long runtimes for wrong size values in cross-reference and object streams
pypdf has long runtimes for wrong size values in cross-reference and object streams
CVE-2026-40260Medium· 5.3pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
CVE-2025-66019Mediumpypdf's LZWDecode streams be manipulated to exhaust RAM
pypdf's LZWDecode streams be manipulated to exhaust RAM
CVE-2025-62707High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inl…
CVE-2025-62708High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWD…
CVE-2025-55197MediumPyPDF's Manipulated FlateDecode streams can exhaust RAM
PyPDF's Manipulated FlateDecode streams can exhaust RAM
CVE-2023-46250Medium· 5.1Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
CVE-2023-36464Medium· 6.2pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character
pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character