pypdf has 23 CVEs on record between 2023 and 2026. Cadence is steady at roughly 7 per quarter. The busiest recent month was October 2026 with 7. The median CVSS is 6.1 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-400 (7) and CWE-835 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 7 prev 7
Worst active — by depth score
CVE-2026-115585High· 7.1pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)39CVE-2026-115580High· 7.1pypdf: Possible long runtimes for large xref table header limits39CVE-2026-115572High· 7.1pypdf: Possible long runtimes for repeated references to the same missing object39CVE-2026-41314Medium· 6.5pypdf: Manipulated FlateDecode image dimensions can exhaust RAM36CVE-2026-41313Medium· 6.5pypdf: Possible long runtimes for wrong size values in incremental mode36
pypdf vulnerabilities
CVEs affecting pypdf, newest first. Open any entry for full detail, references, and exploit status.
23 CVEsRSS
CVE-2026-115572High· 7.1pypdf: Possible long runtimes for repeated references to the same missing object
pypdf: Possible long runtimes for repeated references to the same missing object
CVE-2026-115585High· 7.1pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-115580High· 7.1pypdf: Possible long runtimes for large xref table header limits
pypdf: Possible long runtimes for large xref table header limits
CVE-2026-113789Medium· 6.0pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypdf: Possible long runtimes/large memory usage when retrieving form fields
CVE-2026-113791Medium· 6.0pypdf: Possible large memory usage when parsing content streams
pypdf: Possible large memory usage when parsing content streams
CVE-2026-113795Medium· 6.0pypdf: Possible large memory usage for streams with multiple filters
pypdf: Possible large memory usage for streams with multiple filters
CVE-2026-113793Medium· 6.0pypdf: Possible infinite loop when removing tree items
pypdf: Possible infinite loop when removing tree items
CVE-2026-54651Mediumpypdf: Possible infinite loop when processing threads/articles in writer
pypdf: Possible infinite loop when processing threads/articles in writer
CVE-2026-57204Mediumpypdf: Missing stream length values ignore defined limits
pypdf: Missing stream length values ignore defined limits
GHSA-jm82-fx9c-mx94Mediumpypdf: Missing stream length values ignore defined limits
pypdf: Missing stream length values ignore defined limits
CVE-2026-49460Mediumpypdf: Inefficient decoding of FlateDecode PNG predictor streams
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
CVE-2026-49461Mediumpypdf: Possible large memory usage for form XObjects during text extraction
pypdf: Possible large memory usage for form XObjects during text extraction
CVE-2026-54530Mediumpypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
CVE-2026-54531Mediumpypdf: Possible infinite loop when processing outlines/bookmarks in writer
pypdf: Possible infinite loop when processing outlines/bookmarks in writer
CVE-2026-41314Medium· 6.5pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
CVE-2026-41312Medium· 6.5pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
CVE-2026-41313Medium· 6.5pypdf: Possible long runtimes for wrong size values in incremental mode
pypdf: Possible long runtimes for wrong size values in incremental mode
CVE-2026-41168Medium· 5.3pypdf has long runtimes for wrong size values in cross-reference and object streams
pypdf has long runtimes for wrong size values in cross-reference and object streams
CVE-2026-40260Medium· 5.3pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
CVE-2025-66019Mediumpypdf's LZWDecode streams be manipulated to exhaust RAM
pypdf's LZWDecode streams be manipulated to exhaust RAM
CVE-2025-55197MediumPyPDF's Manipulated FlateDecode streams can exhaust RAM
PyPDF's Manipulated FlateDecode streams can exhaust RAM
CVE-2023-46250Medium· 5.1Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
CVE-2023-36464Medium· 6.2pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character
pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character