pypdf 6.21.2

Direct Vulnerabilities

Known vulnerabilities in the pypdf package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `page_labels` property in `pypdf/_doc_common.py`, which calls `index2label` once per page and each call scans the `/Nums` array from the beginning. An attacker can supply a PDF with a large number of pages and a flat `/Nums` page-label number tree, causing the label-building loop to execute in O(pages × label-ranges) time and exhaust CPU resources. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `pypdf` to version 6.21.3 or higher.	[,6.21.3)
H Allocation of Resources Without Limits or Throttling pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `_flatten_leaf_page` function in `pypdf/_doc_common.py`, where processing a malicious PDF with an excessive number of page dictionary entries during page tree flattening causes unbounded resource consumption, crashing the process. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `pypdf` to version 6.21.4 or higher.	[,6.21.4)
H Allocation of Resources Without Limits or Throttling pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via `_read_pdf15_xref_stream` in `pypdf/_reader.py` when parsing a PDF containing highly compressible cross-reference (xref) streams. An attacker can craft a PDF where xref streams declare millions of entries within normal stream size bounds, and chain multiple streams via `/Prev` to multiply the effect, causing unbounded memory and CPU consumption that crashes the process. Additionally, negative `/Index` counts were accepted, allowing bypass of the existing per-stream entry clamp. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `pypdf` to version 6.21.3 or higher.	[,6.21.3)
H Asymmetric Resource Consumption (Amplification) pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via processing of malformed PDF dictionaries in `pypdf/generic/_data_structures.py`. When a dictionary object is left open (unclosed), error message accumulation during parsing can grow without bound, exhausting available memory and crashing the process. An attacker can trigger this condition by supplying a PDF file containing an unclosed dictionary to any application that parses it with this library. How to fix Asymmetric Resource Consumption (Amplification)? Upgrade `pypdf` to version 6.21.3 or higher.	[,6.21.3)
H Infinite loop pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via `_read_standard_xref_table` in `pypdf/_reader.py`, where a malformed PDF containing a standard cross-reference table that never reaches a `trailer` keyword causes the parser to seek back to the same stream position indefinitely, resulting in an infinite loop and a crash. An attacker can trigger this condition by supplying a PDF with a crafted or truncated xref section. How to fix Infinite loop? Upgrade `pypdf` to version 6.21.4 or higher.	[,6.21.4)
H Infinite loop pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via the `_clone` method in `pypdf/generic/_data_structures.py` when cloning a `DictionaryObject` that contains cyclic references. The loop-detection logic incorrectly checked the indirect reference of the newly generated clone object rather than the original source object, causing certain cycles to go undetected and resulting in an infinite loop that crashes the process. How to fix Infinite loop? Upgrade `pypdf` to version 6.21.4 or higher.	[,6.21.4)
H Allocation of Resources Without Limits or Throttling pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via `get_num_pages()` in `pypdf/_doc_common.py`, which returns the raw `/Count` value from an encrypted PDF's page tree without validation, even after a successful `decrypt()` call. An attacker can supply a PDF with a forged `/Count` value, causing huge memory allocations in operations such as `page_labels` and crashing the process. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `pypdf` to version 6.21.3 or higher.	[,6.21.3)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling