Update dependency pypdf to v6.13.0 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	6.5.0 → 6.13.0

---

pypdf has possible long runtimes for missing /Root object with large /Size values

CVE-2026-22690 / GHSA-4xc4-762w-m6cg

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds

from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))

Resources

This issue has been fixed in #​3594.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg
• https://github.com/py-pdf/pypdf/pull/3594
• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-22690
• https://github.com/advisories/GHSA-4xc4-762w-m6cg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has possible long runtimes for malformed startxref

CVE-2026-22691 / GHSA-4f6g-68pf-7vhv

More information

Details

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds

from pypdf import PdfReader, PdfWriter

##### Instead of
reader = PdfReader("file.pdf")

##### use the strict mode:
reader = PdfReader("file.pdf", strict=True)

##### Instead of
writer = PdfWriter(clone_from="file.pdf")

##### use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))

Resources

This issue has been fixed in #​3594.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv
• https://github.com/py-pdf/pypdf/pull/3594
• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-22691
• https://github.com/advisories/GHSA-4f6g-68pf-7vhv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has possible Infinite Loop when processing outlines/bookmarks

CVE-2026-24688 / GHSA-2q4j-m29v-hq73

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.

Patches

This has been fixed in pypdf 6.6.2.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3610.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73
• https://github.com/py-pdf/pypdf/pull/3610
• https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1
• https://github.com/py-pdf/pypdf/releases/tag/6.6.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-24688
• https://github.com/advisories/GHSA-2q4j-m29v-hq73

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has a possible infinite loop when processing TreeObject

CVE-2026-27024 / GHSA-996q-pr4m-cvgq

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3645.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq
• https://github.com/py-pdf/pypdf/pull/3645
• https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27024
• https://github.com/advisories/GHSA-996q-pr4m-cvgq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

CVE-2026-27025 / GHSA-wgvp-vg3v-2xq3

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3646.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3
• https://github.com/py-pdf/pypdf/pull/3646
• https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27025
• https://github.com/advisories/GHSA-wgvp-vg3v-2xq3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf possibly has long runtimes for malformed FlateDecode streams

CVE-2026-27026 / GHSA-9mvc-8737-8j8h

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3644.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h
• https://github.com/py-pdf/pypdf/pull/3644
• https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27026
• https://github.com/advisories/GHSA-9mvc-8737-8j8h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

CVE-2026-27628 / GHSA-2rw7-x74f-jg35

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.

Patches

This has been fixed in pypdf==6.7.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3655.

Severity

• CVSS Score: 1.2 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35
• https://nvd.nist.gov/vuln/detail/CVE-2026-27628
• https://github.com/py-pdf/pypdf/issues/3654
• https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d
• https://github.com/advisories/GHSA-2rw7-x74f-jg35

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

CVE-2026-27888 / GHSA-x7hp-r3qg-r3cj

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode.

Patches

This has been fixed in pypdf==6.7.3.

Workarounds

If projects cannot upgrade yet, consider applying the changes from PR #​3658.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj
• https://nvd.nist.gov/vuln/detail/CVE-2026-27888
• https://github.com/py-pdf/pypdf/pull/3658
• https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c
• https://github.com/py-pdf/pypdf/releases/tag/6.7.3
• https://github.com/advisories/GHSA-x7hp-r3qg-r3cj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated RunLengthDecode streams can exhaust RAM

CVE-2026-28351 / GHSA-f2v5-7jq9-h8cg

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.

Patches

This has been fixed in pypdf==6.7.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3664.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg
• https://nvd.nist.gov/vuln/detail/CVE-2026-28351
• https://github.com/py-pdf/pypdf/pull/3664
• https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858
• https://github.com/py-pdf/pypdf/releases/tag/6.7.4
• https://github.com/advisories/GHSA-f2v5-7jq9-h8cg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

CVE-2026-28804 / GHSA-9m86-7pmv-2852

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter.

Patches

This has been fixed in pypdf==6.7.5.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3666.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852
• https://github.com/py-pdf/pypdf/pull/3666
• https://github.com/py-pdf/pypdf/releases/tag/6.7.5
• https://nvd.nist.gov/vuln/detail/CVE-2026-28804
• https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f
• https://github.com/advisories/GHSA-9m86-7pmv-2852

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: manipulated stream length values can exhaust RAM

CVE-2026-31826 / GHSA-hqmh-ppp3-xvm7

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream.

Patches

This has been fixed in pypdf==6.8.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3675.

As far as we are aware, this mostly affects reading from buffers of unknown size, as returned by open("file.pdf", mode="rb") for example. Passing a file path or a BytesIO buffer to pypdf instead does not seem to trigger the vulnerability.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7
• https://github.com/py-pdf/pypdf/pull/3675
• https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa
• https://github.com/py-pdf/pypdf/releases/tag/6.8.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-31826
• https://github.com/advisories/GHSA-hqmh-ppp3-xvm7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has inefficient decoding of array-based streams

CVE-2026-33123 / GHSA-qpxp-75px-xjcp

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.

Patches

This has been fixed in pypdf==6.9.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3686.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp
• https://github.com/py-pdf/pypdf/pull/3686
• https://github.com/py-pdf/pypdf/releases/tag/6.9.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33123
• https://github.com/advisories/GHSA-qpxp-75px-xjcp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

CVE-2026-33699 / GHSA-87mj-5ggw-8qc3

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3693.

Severity

• CVSS Score: 4.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3
• https://github.com/py-pdf/pypdf/pull/3693
• https://github.com/py-pdf/pypdf/releases/tag/6.9.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-33699
• https://github.com/advisories/GHSA-87mj-5ggw-8qc3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx
• https://github.com/py-pdf/pypdf/pull/3724
• https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8
• https://github.com/py-pdf/pypdf/releases/tag/6.10.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-40260
• https://github.com/advisories/GHSA-3crg-w4f6-42mx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf has long runtimes for wrong size values in cross-reference and object streams

CVE-2026-41168 / GHSA-jj6c-8h6c-hppx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx
• https://github.com/py-pdf/pypdf/pull/3733
• https://github.com/py-pdf/pypdf/releases/tag/6.10.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-41168
• https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3
• https://github.com/advisories/GHSA-jj6c-8h6c-hppx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for wrong size values in incremental mode

CVE-2026-41313 / GHSA-4pxv-j86v-mhcw

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw
• https://github.com/py-pdf/pypdf/pull/3735
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41313
• https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a
• https://github.com/advisories/GHSA-4pxv-j86v-mhcw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

CVE-2026-41312 / GHSA-7gw9-cf7v-778f

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f
• https://github.com/py-pdf/pypdf/pull/3734
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41312
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
• https://github.com/advisories/GHSA-7gw9-cf7v-778f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

CVE-2026-41314 / GHSA-x284-j5p8-9c5p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p
• https://github.com/py-pdf/pypdf/pull/3734
• https://github.com/py-pdf/pypdf/releases/tag/6.10.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41314
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
• https://github.com/advisories/GHSA-x284-j5p8-9c5p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

CVE-2026-48156 / GHSA-248m-82v9-q6g6

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #​3791.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6
• https://nvd.nist.gov/vuln/detail/CVE-2026-48156
• https://github.com/py-pdf/pypdf/pull/3791
• https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-248m-82v9-q6g6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large offsets for layout mode text

CVE-2026-48155 / GHSA-cj93-chg6-vgv8

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to immediately upgrade, they should consider applying the changes from PR #​3790.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48155
• https://github.com/py-pdf/pypdf/pull/3790
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-cj93-chg6-vgv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Manipulated XMP metadata streams can exhaust RAM

CVE-2026-48735 / GHSA-wjqc-6w8f-h24c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

Patches

This has been fixed in pypdf==6.12.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3796.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
• https://nvd.nist.gov/vuln/detail/CVE-2026-48735
• https://github.com/py-pdf/pypdf/pull/3796
• https://github.com/py-pdf/pypdf/releases/tag/6.12.1
• https://github.com/advisories/GHSA-wjqc-6w8f-h24c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

CVE-2026-49460 / GHSA-5hgr-hg42-57jg

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3806.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
• https://github.com/py-pdf/pypdf/pull/3806
• https://github.com/py-pdf/pypdf/releases/tag/6.12.2
• https://github.com/advisories/GHSA-5hgr-hg42-57jg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for form XObjects during text extraction

CVE-2026-49461 / GHSA-j543-4vmf-qm7v

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references.

Patches

This has been fixed in pypdf==6.12.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3805.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v
• https://github.com/py-pdf/pypdf/pull/3805
• https://github.com/py-pdf/pypdf/releases/tag/6.12.2
• https://github.com/advisories/GHSA-j543-4vmf-qm7v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

CVE-2026-54530 / GHSA-52x6-gq3r-vpf4

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4
• https://github.com/py-pdf/pypdf/pull/3830
• https://github.com/py-pdf/pypdf/releases/tag/6.13.0
• https://github.com/advisories/GHSA-52x6-gq3r-vpf4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

CVE-2026-54531 / GHSA-m2v9-299j-rv96

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.

Patches

This has been fixed in pypdf==6.13.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3830.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96
• https://github.com/py-pdf/pypdf/pull/3830
• https://github.com/py-pdf/pypdf/releases/tag/6.13.0
• https://github.com/advisories/GHSA-m2v9-299j-rv96

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.13.0

Compare Source

Security (SEC)

• Prevent infinite loops when processing threads/articles (#​3839)

Full Changelog

v6.12.2

Compare Source

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#​3806)
• Improve loop control in text extraction (#​3805)

Full Changelog

v6.12.1

Compare Source

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#​3806)
• Improve loop control in text extraction (#​3805)

Full Changelog

v6.12.0

Compare Source

Security (SEC)

• Limit input size and element count for XMP metadata (#​3796)

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#​3795)
• Deal with invalid first code in LZW decoder (#​3794)

Full Changelog

v6.11.0

Compare Source

New Features (ENH)

• Initialise a Font from an embedded font file (#​3704)

Robustness (ROB)

• Allow to fix AES padding length in non-strict mode (#​3742)

Developer Experience (DEV)

• Enable PyPy testing again (#​3752)
• Align mypy Makefile target with strict mode (#​3690)

Full Changelog

v6.10.2

Compare Source

Security (SEC)

• Do not rely on possibly invalid /Size for incremental cloning (#​3735)
• Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.1

Compare Source

Security (SEC)

• Do not rely on possibly invalid /Size for incremental cloning (#​3735)
• Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.0

Compare Source

Security (SEC)

• Limit the allowed size of xref and object streams (#​3733)

Robustness (ROB)

• Consider strict mode setting for decryption errors (#​3731)

Documentation (DOC)

• Use new parameter names for compress_identical_objects

Full Changelog

v6.9.2

Compare Source

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#​3693)

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog

v6.9.1

Compare Source

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#​3693)

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog

v6.9.0

Compare Source

Security (SEC)

• Improve performance and limit length of array-based content streams (#​3686)

Full Changelog

v6.8.0

Compare Source

New Features (ENH)

• Expose /Perms verification result on Encryption object (#​3672)

Performance Improvements (PI)

• Fix O(n²) performance in NameObject read/write (#​3679)
• Batch-parse all objects in ObjStm on first access (#​3677)

Bug Fixes (BUG)

• Avoid sharing array-based content streams between pages (#​3681)
• Avoid accessing invalid page when inserting blank page under some conditions (#​3529)

Full Changelog

v6.7.5

Compare Source

Security (SEC)

• Limit allowed /Length value of stream (#​3675)

New Features (ENH)

• Add /IRT (in-reply-to) support for markup annotations (#​3631)

Documentation (DOC)

• Avoid using PageObject.replace_contents on PdfReader (#​3669)
• Document how to disable jbig2dec calls

Full Changelog

v6.7.4

Compare Source

Security (SEC)

• Improve the performance of the ASCIIHexDecode filter (#​3666)

Full Changelog

v6.7.3

Compare Source

Security (SEC)

• Allow limiting output length for RunLengthDecode filter (#​3664)

Robustness (ROB)

• Deal with invalid annotations in extract_links (#​3659)

Full Changelog

v6.7.2

Compare Source

Security (SEC)

• Use zlib decompression limit when retrieving XFA data (#​3658)

Full Changelog

v6.7.1

Compare Source

Security (SEC)

• Prevent infinite loop from circular xref /Prev references (#​3655)

Bug Fixes (BUG)

• Fix wrong LUT size error (#​3651)
• Fix handling of page boxes defined on /Pages (#​3650)

Full Changelog

[v6.7.0](https://redirect.github.co

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ali-sedaghatbaf]

LGTM!