Most recent entries from all

fkie_cve-2026-102999

2026-10-02T10:34:21.181269+00:00

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

GHSA-v247-6f48-mgcj — pypdf: Possible long runtimes with large amount of embedded files

2026-10-02T10:34:21.181398+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.

### Patches

This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4081](https://github.com/py-pdf/pypdf/pull/4081).

PYSEC-2026-4159 — pypdf: Possible long runtimes with large amount of embedded files