See how py-pdf compares to other vendors in security performance
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4269.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4270.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4265.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4251.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4288.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4290.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4289.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4218.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4219.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4218.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling findoutlineitem on a PdfWriter.
Patches
This has been fixed in pypdf==6.20.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4188.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.
Patches
This has been fixed in pypdf==6.20.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4170.
Notes
This has been reported through both the secure channel and as a public issue at #4169.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.
Patches
This has been fixed in pypdf==6.20.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4173.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.
Patches
This has been fixed in pypdf==6.20.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4188.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels.
Patches
This has been fixed in pypdf==6.19.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4096.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.
Patches
This has been fixed in pypdf==6.19.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4081.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation.
Patches
This has been fixed in pypdf==6.19.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4087.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed /FlateDecode stream, where the byte-by-byte decompression is used.
Patches
This has been fixed in pypdf==6.18.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4073.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.18.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4072.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.18.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4071.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.
Patches
This has been fixed in pypdf==6.18.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4055.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.
Patches
This has been fixed in pypdf==6.17.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4047.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insertchild is involved.
Patches
This has been fixed in pypdf==6.16.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3964.
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time.
Patches This has been fixed in pypdf==6.15.0.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3947.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.15.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3944.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.
Patches
This has been fixed in pypdf==6.15.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3946.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
Patches
This has been fixed in pypdf==6.14.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3891.
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.
Patches
This has been fixed in pypdf==6.14.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3892.