pypdf vulnerabilities

pypdf prior to 6.21.3 can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply parsed entries, while negative /Index counts bypass the existing per-stream clamp.

pypdf prior to 6.21.3 can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree.

pypdf prior to 6.21.3 can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages.

pypdf prior to 6.21.3 can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning.

pypdf prior to 6.21.4 can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check.

pypdf prior to 6.21.4 can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, causing disproportionate allocations.

pypdf before version 6.21.4 can enter an infinite loop when opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating, blocking the processing thread.

In pypdf prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

In pypdf prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

pypdf before version 6.21.2 is vulnerable to an attack where a crafted PDF repeatedly references the same nonexistent indirect object. This triggers repeated full-file recovery loads and long runtimes when accessing parts such as pages. The issue is fixed in version 6.21.2.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

pypdf before version 6.20.1 can enter an infinite loop when removing an object from a crafted cyclic PDF tree, such as an outline item, blocking the current process. The issue is fixed in version 6.20.1.

pypdf before version 6.20.1 can enter an infinite loop when calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy, blocking the current process. The issue is fixed in version 6.20.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

In pypdf before 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This is fixed in version 6.21.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

In pypdf (Python PDF library) prior to version 6.16.1, an attacker can craft a PDF that causes PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

In pypdf (Python PDF library) prior to version 6.16.1, an attacker can craft a PDF that causes _get_outline in _doc_common.py to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

pypdf prior to 6.15.0 has a vulnerability causing long runtimes when the function read_until_whitespace in pypdf/_utils.py reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost.

pypdf prior to 6.15.0 is vulnerable to excessive memory consumption when parsing crafted PDFs, as the parse_bfrange function in pypdf/_cmap.py handles unusually large tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in version 6.15.0.

A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.

In pypdf library prior to version 6.14.1, a vulnerability was found causing an infinite loop when processing inline images in PDF page content streams. An attacker can craft a malicious PDF with a not terminated inline image, leading to a hang during text extraction.

The pypdf library prior to version 6.14.2 is vulnerable to a DoS attack due to an infinite loop when parsing PDF files. An attacker can craft a malicious PDF with a not terminated inline image using ASCII85 or ASCIIHex filters, causing the process to hang.

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with declared image size values much larger than the actual data, causing excessive memory usage during image parsing. This can be exploited for a denial-of-service (DoS) attack by exhausting memory resources.

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with multiple malformed cross-reference streams, causing long runtimes for recovering broken cross-reference table entries. This leads to excessive CPU usage and processing delays.

The pypdf library before version 6.13.3 contains a DoS vulnerability. A specially crafted PDF can cause excessive memory usage because the MAX_DECLARED_STREAM_LENGTH constant is sometimes ignored when parsing a content stream without a /Length value.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.1, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.0, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.0, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop when extracting text in layout mode.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.12.2, an attacker could craft a PDF that leads to large memory usage by extracting text from a page containing a form XObject with self-references.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.12.2, an attacker could exploit this vulnerability to craft a PDF that leads to long runtimes.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that exhausts RAM. This requires accessing an image using /FlateDecode with large size values. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that causes long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that exhausts RAM. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal to 1 and large predictor parameters. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.1, an attacker can craft a PDF that causes long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. This is fixed in pypdf 6.10.1.

In pypdf versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker can craft a PDF that causes excessive memory usage when XMP metadata is parsed. This issue is fixed in version 6.10.0.

In pypdf versions prior to 6.9.1, an attacker can craft a malicious PDF that causes long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue is fixed in version 6.9.1.

pypdf before 6.8.0 allows an attacker to craft a PDF that causes excessive memory usage. This requires parsing a content stream with a very large /Length value regardless of the actual data length.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker can craft a PDF that leads to long runtimes when accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.