CVE-2026-57204

pypdf: Missing stream length values ignore defined limits

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-59935

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-59936

pypdf: Possible infinite loop for not terminated inline images

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-59937

pypdf: Possible long runtimes for repeated malformed cross-reference entries

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-59938

pypdf: Possible large memory usage for wrong image dimensions

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-71852

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-115585

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-115580

pypdf: Possible long runtimes for large xref table header limits

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-115572

pypdf: Possible long runtimes for repeated references to the same missing object

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-114610

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Fpdf2

CVE-2026-114609

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Fpdf2

CVE-2026-113786

pypdf: Unvalidated JPEG image data loading

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf