By vendor
Pypdf_project vulnerabilities
Known CVEs affecting Pypdf_project products, prioritized by severity, with SEC.co remediation and detection guidance.
13 published vulnerabilities
- CVE-2026-59935HIGH 7.5
A crafted PDF file can cause pypdf to hang indefinitely when processing its contents. The attack works by embedding a malformed inline image in the PDF that uses compression filters (ASCII85 or ASCIIHex) but lacks proper termination markers. When pypdf attempts to extract text or parse the page, it enters an infinite loop trying to decode this image data. This denial-of-service condition affects pypdf versions before 6.14.2.
- CVE-2026-59936HIGH 7.5
A vulnerability in pypdf, a popular open-source Python PDF library, allows an attacker to crash or hang applications that process PDFs. By crafting a malicious PDF with a malformed inline image in the page content, an attacker can trigger an infinite loop when the library tries to extract text or process the page. This causes a denial of service, making the application unresponsive. The flaw affects all versions before 6.14.1 and has been patched in that release.
- CVE-2026-59937HIGH 7.5
pypdf, a popular open-source Python library for PDF manipulation, contains a denial-of-service vulnerability in versions prior to 6.14.0. An attacker can create a specially crafted PDF file containing repeated malformed cross-reference streams that force pypdf into excessive processing loops while attempting to recover broken table entries. This causes the application to hang or consume CPU resources, effectively denying service to legitimate users. The vulnerability requires no authentication or user interaction—simply opening the malicious PDF triggers the issue.
- CVE-2026-57204MEDIUM 6.5
pypdf, a widely-used open-source Python library for working with PDF files, contains a denial-of-service vulnerability that allows an attacker to craft a malicious PDF capable of consuming excessive memory on systems that parse it. The flaw stems from the library's failure to properly enforce memory limits when processing PDF content streams that lack explicit length declarations. An attacker would need to trick a user into opening or processing such a PDF, but once they do, the parsing operation can exhaust available memory and crash or severely degrade the affected application.
- CVE-2026-48155MEDIUM 5.5
pypdf, a popular open-source PDF processing library, contains a denial-of-service vulnerability affecting versions prior to 6.12.0. An attacker can craft a malicious PDF file that, when processed by pypdf's text extraction feature in layout mode, triggers excessive memory consumption. This occurs specifically when the PDF contains large character offsets. The flaw does not compromise data confidentiality or integrity, but can render systems unresponsive or crash applications that depend on pypdf for PDF handling.
- CVE-2026-48735MEDIUM 5.5
pypdf, a popular open-source Python library for PDF processing, contains a memory exhaustion flaw that allows attackers to craft malicious PDF files triggering excessive memory consumption. The issue stems from how the library parses XMP (Extensible Metadata Platform) metadata within PDFs—an attacker can embed large or unnecessarily complex metadata structures that force the parser to allocate abnormal amounts of RAM. This can degrade system performance or crash applications relying on pypdf to process untrusted PDF documents. The vulnerability affects versions prior to 6.12.1.
- CVE-2026-49461MEDIUM 5.5
CVE-2026-49461 is a denial-of-service vulnerability in pypdf, a widely-used Python library for PDF processing. An attacker can craft a malicious PDF file that causes excessive memory consumption when a user or application extracts text from a page containing a specially-constructed form XObject with self-referential loops. This does not allow data theft or system compromise, but can exhaust memory resources and crash applications that depend on pypdf. The vulnerability is resolved in version 6.12.2.
- CVE-2026-54530MEDIUM 5.5
pypdf, a widely-used open-source Python PDF library, contains a flaw that allows an attacker to create a specially crafted PDF file capable of causing an application to hang indefinitely. The vulnerability is triggered when the application attempts to extract text from the PDF in layout mode. This is a denial-of-service condition—the application becomes unresponsive but no data is stolen or corrupted. The flaw has been patched in version 6.13.0.
- CVE-2026-54531MEDIUM 5.5
pypdf, a popular open-source Python PDF processing library, contains a flaw that allows an attacker to create a specially crafted PDF file that triggers an infinite loop when that file is merged with outlines (hierarchical document structure metadata) into a writer object. An attacker would need local access to the system and the ability to influence which PDFs are processed, making this a localized denial-of-service risk rather than a remote attack vector. The issue is resolved in pypdf version 6.13.0 and later.
- CVE-2026-54651MEDIUM 5.5
pypdf, a widely-used Python library for PDF manipulation, contains a flaw that allows an attacker to craft a malicious PDF file capable of triggering an infinite loop when that file is merged with other PDFs in a writer operation. The vulnerability specifically occurs when processing PDFs containing threads or articles during a merge operation. An attacker with local access could exploit this to cause a denial of service by exhausting system resources and making applications using the library unresponsive. The issue has been patched in version 6.13.1.
- CVE-2026-59938MEDIUM 5.3
A memory exhaustion vulnerability exists in pypdf, a popular open-source Python PDF library. An attacker can craft a malicious PDF file that declares image dimensions far larger than the actual image data contained within it. When pypdf processes such a file, it allocates excessive memory based on the declared sizes, leading to memory exhaustion and denial of service. The flaw affects all versions prior to 6.14.0 and is resolved in that release.
- CVE-2026-48156LOW 3.3
pypdf, a popular open-source Python library for PDF handling, contains a vulnerability that allows an attacker to craft malicious PDF files that cause the library to consume excessive processing time during parsing. The issue stems from how pypdf processes cross-reference streams—a mechanism PDFs use to index internal objects—when they contain specific structural patterns. An attacker would need to trick a user or application into opening a specially crafted PDF, but once opened, the library can hang or freeze during PDF processing, resulting in a denial-of-service condition on that system.
- CVE-2026-49460LOW 3.3
pypdf, a widely-used open-source Python library for PDF processing, contains a vulnerability in versions prior to 6.12.2 that allows an attacker to craft a malicious PDF file causing the library to consume excessive CPU resources and run for an unusually long time. The attack specifically targets PDFs that use compressed streams with a FlateDecode filter and PNG predictors. While this does not result in data theft or corruption, it can degrade application performance or be used in denial-of-service scenarios where PDF processing is part of a critical workflow.