Most recent entries from all

CVE-2026-102994 — pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

PYSEC-2026-4153 — pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.

### Patches

This has been fixed in [pypdf==6.18.0](https://github.com/py-pdf/pypdf/releases/tag/6.18.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4055](https://github.com/py-pdf/pypdf/pull/4055).