py-pdf has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 6.0 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-835 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.0
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-113794Medium· 6.0pypdf: Possible infinite loop when hitting EOF in standard xref table33CVE-2026-113793Medium· 6.0pypdf: Possible infinite loop when removing tree items33CVE-2026-113792Medium· 6.0pypdf: Possible infinite loop in PdfWriter.find_outline_item33CVE-2026-113790Medium· 6.0pypdf: Possible large memory usage when parsing arrays and dictionaries33CVE-2026-113789Medium· 6.0pypdf: Possible long runtimes/large memory usage when retrieving form fields33
py-pdf vulnerabilities
CVEs affecting py-pdf, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-113789Medium· 6.0pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in versio…
CVE-2026-113790Medium· 6.0pypdf: Possible large memory usage when parsing arrays and dictionaries
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in versio…
CVE-2026-113793Medium· 6.0pypdf: Possible infinite loop when removing tree items
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in versio…
CVE-2026-113794Medium· 6.0pypdf: Possible infinite loop when hitting EOF in standard xref table
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infin…
CVE-2026-113792Medium· 6.0pypdf: Possible infinite loop in PdfWriter.find_outline_item
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed …
CVE-2026-113786Low· 2.3pypdf: Unvalidated JPEG image data loading
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the im…