pypdf vulnerabilities

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker can craft a PDF that leads to large memory usage when parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes long runtimes. This requires a malformed /FlateDecode stream where byte-by-byte decompression is used. This is fixed in 6.7.1.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, e.g. during text extraction. This is fixed in 6.7.1.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes an infinite loop. This requires accessing the children of a TreeObject, e.g. as part of outlines. This is fixed in 6.7.1.

pypdf is a free and open-source pure-python PDF library. An infinite loop vulnerability present in versions prior to 6.6.2 can be triggered by a crafted PDF when accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref entries when rebuilding the cross-reference table, especially for PDF files with lots of whitespace characters. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values when rebuilding the cross-reference table. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

pypdf prior to version 6.4.0 allows an attacker to craft a PDF that leads to memory usage of up to 1 GB per stream when parsing the content stream of a page using the LZWDecode filter.

The pypdf library before version 6.1.3 is vulnerable to an attack causing large memory usage. An attacker can craft a PDF that, when parsing the content stream of a page using the LZWDecode filter, leads to excessive memory consumption. This has been fixed in version 6.1.3.

The pypdf library before version 6.1.3 is vulnerable to an attack causing an infinite loop. An attacker can craft a PDF that, when parsing the content stream of a page with an inline image using the DCTDecode filter, leads to an infinite loop. This has been fixed in version 6.1.3.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to RAM exhaustion, requiring just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access.

In pypdf versions 3.7.0 through 3.16.4, an attacker can craft a PDF that causes an infinite loop. The loop blocks the current process and can utilize a single CPU core at 100%, without affecting memory usage. This is fixed in version 3.17.0.

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker can craft a PDF that leads to unexpected long runtime, blocking the current process and utilizing 100% of a single CPU core.

The pypdf library in version 2.10.5 contains a vulnerability that allows an attacker to craft a PDF leading to an infinite loop. This loop blocks the current process and utilizes 100% of a single CPU core.

The pypdf library, an open-source pure-Python library, has a vulnerability that can lead to an infinite loop when processing a malicious PDF file. This issue occurs in versions where the `__parse_content_stream` method is executed.