Most recent entries from all

CVE-2026-48735 — pypdf: Manipulated XMP metadata streams can exhaust RAM

2026-09-29T23:49:17.048265+00:00

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.

GHSA-wjqc-6w8f-h24c — pypdf: Manipulated XMP metadata streams can exhaust RAM

2026-09-29T23:49:17.048397+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

### Patches This has been fixed in [pypdf==6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1).

### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3796](https://github.com/py-pdf/pypdf/pull/3796).

PYSEC-2026-3025 — pypdf: Manipulated XMP metadata streams can exhaust RAM

2026-09-29T23:49:17.048457+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements.

### Patches This has been fixed in [pypdf==6.12.1](https://github.com/py-pdf/pypdf/releases/tag/6.12.1).

### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3796](https://github.com/py-pdf/pypdf/pull/3796).