[ Vendor · 18 CVEs ]
py-pdf
CVEs affecting py-pdf published in the last 30 days, plus any py-pdf CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114609 | 22 Oct 2026 | CVSS 5.8 | py-pdf fpdf2fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs… | |
| CVE-2026-114610 | 22 Oct 2026 | CVSS 6.5 | py-pdf fpdf2fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to… | |
| CVE-2026-113794 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible infinite loop when hitting EOF in standard xref tablepypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard… | Fix |
| CVE-2026-113795 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible large memory usage for streams with multiple filterspypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple… | Fix |
| CVE-2026-113791 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible large memory usage when parsing content streamspypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small… | Fix |
| CVE-2026-113792 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible infinite loop in PdfWriter.find_outline_itempypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline… | Fix |
| CVE-2026-113793 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible infinite loop when removing tree itemspypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item… | Fix |
| CVE-2026-113789 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible long runtimes/large memory usage when retrieving form fieldspypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes… | Fix |
| CVE-2026-113790 | 21 Oct 2026 | CVSS 6.0 | pypdf: Possible large memory usage when parsing arrays and dictionariespypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many… | Fix |
| CVE-2026-113786 | 21 Oct 2026 | CVSS 2.3 | pypdf: Unvalidated JPEG image data loadingpypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the… | Fix |
| CVE-2026-102997 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with… | Fix |
| CVE-2026-102998 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes when generating appearance streamspypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause… | Fix |
| CVE-2026-102999 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes with large amount of embedded filespypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based… | Fix |
| CVE-2026-103000 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when retrieving alphabetical page labelspypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values… | Fix |
| CVE-2026-102995 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string… | Fix |
| CVE-2026-102996 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when parsing font datapypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually… | Fix |
| CVE-2026-102994 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes/large memory usage when parsing indirect objectspypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number… | Fix |
| CVE-2026-102993 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when retrieving Roman page labelspypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that… | Fix |