Vendor
Pypdf Project
53 known vulnerabilities in products by Pypdf Project, 0 of them actively exploited (CISA KEV).
Key figures
53
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-59935 | pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) | 7.5 | |
| High | CVE-2026-59936 | pypdf: Possible infinite loop for not terminated inline images | 7.5 | |
| High | CVE-2026-103000 | pypdf: Possible large memory usage when retrieving alphabetical page labels | 7.5 | |
| High | CVE-2026-102999 | pypdf: Possible long runtimes with large amount of embedded files | 7.5 | |
| High | CVE-2026-102993 | pypdf: Possible large memory usage when retrieving Roman page labels | 7.5 | |
| High | CVE-2026-102996 | pypdf: Possible large memory usage when parsing font data | 7.5 | |
| High | CVE-2026-102995 | pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) | 7.5 | |
| High | CVE-2026-102998 | pypdf: Possible long runtimes when generating appearance streams | 7.5 | |
| High | CVE-2026-102997 | pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) | 7.5 | |
| High | CVE-2026-102994 | pypdf: Possible long runtimes/large memory usage when parsing indirect objects | 7.5 | |
| High | CVE-2026-59937 | pypdf: Possible long runtimes for repeated malformed cross-reference entries | 7.5 | |
| Medium | CVE-2026-82398 | pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace | 5.3 | |
| High | CVE-2026-119209 | pypdf: Possible large memory usage when parsing cross-reference streams | 5.5 | |
| Medium | CVE-2026-59938 | pypdf: Possible large memory usage for wrong image dimensions | 5.3 | |
| High | CVE-2026-33699 | pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream | 7.5 | |
| Medium | CVE-2026-28351 | Manipulated RunLengthDecode streams can exhaust RAM | 5.3 | |
| Medium | CVE-2026-57204 | pypdf: Missing stream length values ignore defined limits | 6.5 | |
| Medium | CVE-2026-40260 | pypdf: Manipulated XMP metadata entity declarations can exhaust RAM | 5.3 | |
| High | CVE-2025-55197 | pypdf's Manipulated FlateDecode streams can exhaust RAM | 7.5 | |
| High | CVE-2026-27888 | pypdf: Manipulated FlateDecode XFA streams can exhaust RAM | 7.5 | |
| High | CVE-2026-27628 | pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams | 7.5 | |
| High | CVE-2025-62708 | pypdf manipulated LZWDecode streams can exhaust RAM | 7.5 | |
| High | CVE-2025-62707 | pypdf affected by possible infinite loop when reading DCT inline images without EOF marker | 7.5 | |
| Medium | CVE-2026-84309 | pypdf: Possible infinite loop for TreeObject.insert_child | 5.5 | |
| Medium | CVE-2026-28804 | pypdf: Inefficient decoding of ASCIIHexDecode streams | 5.3 |
Products
| Pypdf Project Pypdf | 53 | 0 |