Allocation of Resources Without Limits or Throttlingpypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the page_labels property in pypdf/_doc_common.py, which calls index2label once per page and each call scans the /Nums array from the beginning. An attacker can supply a PDF with a large number of pages and a flat /Nums page-label number tree, causing the label-building loop to execute in O(pages × label-ranges) time and exhaust CPU resources.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade pypdf to version 6.21.3 or higher.
| |
Allocation of Resources Without Limits or Throttlingpypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the _flatten_leaf_page function in pypdf/_doc_common.py, where processing a malicious PDF with an excessive number of page dictionary entries during page tree flattening causes unbounded resource consumption, crashing the process.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade pypdf to version 6.21.4 or higher.
| |
Allocation of Resources Without Limits or Throttlingpypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via _read_pdf15_xref_stream in pypdf/_reader.py when parsing a PDF containing highly compressible cross-reference (xref) streams. An attacker can craft a PDF where xref streams declare millions of entries within normal stream size bounds, and chain multiple streams via /Prev to multiply the effect, causing unbounded memory and CPU consumption that crashes the process. Additionally, negative /Index counts were accepted, allowing bypass of the existing per-stream entry clamp.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade pypdf to version 6.21.3 or higher.
| |
Asymmetric Resource Consumption (Amplification)pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via processing of malformed PDF dictionaries in pypdf/generic/_data_structures.py. When a dictionary object is left open (unclosed), error message accumulation during parsing can grow without bound, exhausting available memory and crashing the process. An attacker can trigger this condition by supplying a PDF file containing an unclosed dictionary to any application that parses it with this library.
How to fix Asymmetric Resource Consumption (Amplification)? Upgrade pypdf to version 6.21.3 or higher.
| |
Infinite looppypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Infinite loop via _read_standard_xref_table in pypdf/_reader.py, where a malformed PDF containing a standard cross-reference table that never reaches a trailer keyword causes the parser to seek back to the same stream position indefinitely, resulting in an infinite loop and a crash. An attacker can trigger this condition by supplying a PDF with a crafted or truncated xref section.
How to fix Infinite loop? Upgrade pypdf to version 6.21.4 or higher.
| |
Infinite looppypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Infinite loop via the _clone method in pypdf/generic/_data_structures.py when cloning a DictionaryObject that contains cyclic references. The loop-detection logic incorrectly checked the indirect reference of the newly generated clone object rather than the original source object, causing certain cycles to go undetected and resulting in an infinite loop that crashes the process.
How to fix Infinite loop? Upgrade pypdf to version 6.21.4 or higher.
| |
Allocation of Resources Without Limits or Throttlingpypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via get_num_pages() in pypdf/_doc_common.py, which returns the raw /Count value from an encrypted PDF's page tree without validation, even after a successful decrypt() call. An attacker can supply a PDF with a forged /Count value, causing huge memory allocations in operations such as page_labels and crashing the process.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade pypdf to version 6.21.3 or higher.
| |
Denial of Service (DoS)pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Denial of Service (DoS) via repeated full file reads triggered by malformed PDF input. When get_object in pypdf/_reader.py encounters an invalid or unresolvable indirect object reference, it falls back to scanning the entire file stream on every lookup for that object rather than caching the failed resolution. Similarly, _read_standard_xref_table re-reads the full stream buffer on each cross-reference recovery attempt. An attacker can supply a PDF containing invalid objects or a corrupt cross-reference table to cause unbounded repeated full-file I/O, crashing or hanging the process.
How to fix Denial of Service (DoS)? Upgrade pypdf to version 6.21.2 or higher.
| |
Denial of Service (DoS)pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Denial of Service (DoS) via repeated full file loads triggered by malformed PDF input. When get_object in pypdf/_reader.py encounters an invalid or unresolvable indirect object reference, it falls back to a full sequential scan of the underlying stream on every access attempt, rather than caching the result. Similarly, _read_standard_xref_table re-reads the entire file buffer each time a cross-reference entry fails to parse during recovery. An attacker can supply a PDF containing many such invalid objects or a corrupt cross-reference table, causing the parser to repeatedly read the full file into memory and exhausting available resources.
How to fix Denial of Service (DoS)? Upgrade pypdf to version 6.21.2 or higher.
| |
Excessive Iterationpypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Excessive Iteration via _read_standard_xref_table in pypdf/_reader.py, where a PDF file containing a cross-reference (xref) table with a declared size far exceeding the actual file size causes unbounded memory allocation. An attacker can supply a malicious PDF to trigger this condition and crash the process.
How to fix Excessive Iteration? Upgrade pypdf to version 6.21.2 or higher.
| |
Permissive List of Allowed Inputspypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via _xobj_to_image in pypdf/generic/_image_xobject.py, which passes /DCTDecode stream data to Image.open() without restricting the Pillow plugin format. Pillow sniffs the stream bytes to select a plugin, allowing non-JPEG data embedded in a DCT stream to be processed by arbitrary plugins, including EpsImagePlugin, which executes Ghostscript on embedded PostScript content. An attacker who can supply a malicious PDF causes arbitrary command execution on the host when the PDF's image objects are processed.
Note: This is only exploitable when Ghostscript (gs) is installed on the host system.
How to fix Permissive List of Allowed Inputs? Upgrade pypdf to version 6.21.1 or higher.
| |
