Skip to content

Update dependency pypdf to v6.10.2 [SECURITY]#307

Open
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/pypi-pypdf-vulnerability
Open

Update dependency pypdf to v6.10.2 [SECURITY]#307
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/pypi-pypdf-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 25, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
pypdf (changelog) ==6.9.2 → ==6.10.2 age confidence

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pypdf has long runtimes for wrong size values in cross-reference and object streams

CVE-2026-41168 / GHSA-jj6c-8h6c-hppx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for wrong size values in incremental mode

CVE-2026-41313 / GHSA-4pxv-j86v-mhcw

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

CVE-2026-41312 / GHSA-7gw9-cf7v-778f

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

CVE-2026-41314 / GHSA-x284-j5p8-9c5p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

CVE-2026-40260 / GHSA-3crg-w4f6-42mx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3724.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf has long runtimes for wrong size values in cross-reference and object streams

GHSA-jj6c-8h6c-hppx

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3733.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Possible long runtimes for wrong size values in incremental mode

GHSA-4pxv-j86v-mhcw

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3735.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

GHSA-7gw9-cf7v-778f

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal 1 and large predictor parameters.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

GHSA-x284-j5p8-9c5p

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using /FlateDecode with large size values.

Patches

This has been fixed in pypdf==6.10.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3734.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

py-pdf/pypdf (pypdf)

v6.10.2

Compare Source

Security (SEC)
  • Do not rely on possibly invalid /Size for incremental cloning (#​3735)
  • Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.1

Compare Source

Security (SEC)
  • Do not rely on possibly invalid /Size for incremental cloning (#​3735)
  • Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.0

Compare Source

Security (SEC)
  • Limit the allowed size of xref and object streams (#​3733)
Robustness (ROB)
  • Consider strict mode setting for decryption errors (#​3731)
Documentation (DOC)
  • Use new parameter names for compress_identical_objects

Full Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 25, 2026 •
edited
Loading

Coverage report

This PR does not seem to contain any modification to coverable code.

@renovate renovate Bot changed the title Update dependency pypdf to v6.9.2 [SECURITY] Update dependency pypdf to v6.9.2 [SECURITY] - autoclosed Apr 7, 2026
@renovate renovate Bot closed this Apr 7, 2026
@renovate renovate Bot deleted the renovate/pypi-pypdf-vulnerability branch April 7, 2026 13:37
@renovate renovate Bot changed the title Update dependency pypdf to v6.9.2 [SECURITY] - autoclosed Update dependency pypdf to v6.10.0 [SECURITY] Apr 11, 2026
@renovate renovate Bot reopened this Apr 11, 2026
@renovate renovate Bot force-pushed the renovate/pypi-pypdf-vulnerability branch 2 times, most recently from 9801922 to bcc16aa Compare April 11, 2026 00:51
@renovate renovate Bot changed the title Update dependency pypdf to v6.10.0 [SECURITY] Update dependency pypdf to v6.10.1 [SECURITY] Apr 16, 2026
@renovate renovate Bot force-pushed the renovate/pypi-pypdf-vulnerability branch from bcc16aa to a9220a0 Compare April 16, 2026 08:34
@renovate renovate Bot force-pushed the renovate/pypi-pypdf-vulnerability branch from a9220a0 to 0536cfb Compare April 17, 2026 01:54
@renovate renovate Bot changed the title Update dependency pypdf to v6.10.1 [SECURITY] Update dependency pypdf to v6.10.2 [SECURITY] Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants