https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T19:44:47.333961+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-pdfalyzer-cve-2026-102997 BREW-pdfalyzer-CVE-2026-102997 — pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) 2026-10-03T19:44:47.341269+00:00

Affected: Homebrew: pdfalyzer

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `/FlateDecode` stream, where the byte-by-byte decompression is used.

### Patches

This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4073](https://github.com/py-pdf/pypdf/pull/4073).

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-102997 fkie_cve-2026-102997 2026-10-03T19:44:47.341375+00:00

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

 https://vulnerability.circl.lu/vuln/ghsa-jw7q-gvrg-4vj3 GHSA-jw7q-gvrg-4vj3 — pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) 2026-10-03T19:44:47.341431+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `/FlateDecode` stream, where the byte-by-byte decompression is used.

### Patches

This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4073](https://github.com/py-pdf/pypdf/pull/4073).

 https://vulnerability.circl.lu/vuln/pysec-2026-4156 PYSEC-2026-4156 — pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) 2026-10-03T19:44:47.341478+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `/FlateDecode` stream, where the byte-by-byte decompression is used.

### Patches

This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4073](https://github.com/py-pdf/pypdf/pull/4073).

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-102997 UBUNTU-CVE-2026-102997 2026-10-03T19:44:47.341520+00:00

Affected: Ubuntu:Pro:16.04:LTS: pypdf2, Ubuntu:Pro:18.04:LTS: pypdf2, Ubuntu:20.04:LTS: pypdf2, Ubuntu:22.04:LTS: pypdf2, Ubuntu:24.04:LTS: pypdf, Ubuntu:24.04:LTS: pypdf2, Ubuntu:26.04:LTS: pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.