{"schema_version":1,"title":"Py-Pdf Pypdf vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 42 vulnerabilities in Py-Pdf Pypdf: 0 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119209, was published on 29 October 2026. 13 vulnerabilities in the last four weeks, up 63% on the four before (8).","url":"https://junglewise.ai/threats/technologies/py-pdf-pypdf","json_url":"https://junglewise.ai/threats/technologies/py-pdf-pypdf.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/py-pdf-pypdf","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":18,"all_time":42,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":13,"last_90_days":21,"last_365_days":42},"latest":[{"cve":"CVE-2026-119209","cvss":4,"epss":0.0027,"slug":"cve-2026-119209-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf memory exhaustion in cross-reference stream parsing","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:20.23+00:00","url":"https://junglewise.ai/threats/cve-2026-119209-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119207","cvss":4,"epss":0.003,"slug":"cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf excessive memory consumption in strict mode PDF parsing","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.953+00:00","url":"https://junglewise.ai/threats/cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119206","cvss":4,"epss":0.003,"slug":"cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service via crafted page labels","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.817+00:00","url":"https://junglewise.ai/threats/cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119205","cvss":4,"epss":0.003,"slug":"cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf infinite loop in DictionaryObject cloning","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.677+00:00","url":"https://junglewise.ai/threats/cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119204","cvss":4,"epss":0.003,"slug":"cve-2026-119204-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf excessive memory consumption in PDF page tree parsing","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.527+00:00","url":"https://junglewise.ai/threats/cve-2026-119204-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-115585","cvss":4,"epss":0.0053,"slug":"cve-2026-115585-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf incomplete remediation causing excessive PDF stream reloads","severity":"high","exploited":false,"published_at":"2026-10-23T20:17:21.23+00:00","url":"https://junglewise.ai/threats/cve-2026-115585-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-115572","cvss":4,"epss":0.0053,"slug":"cve-2026-115572-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf repeated PDF object reference denial of service","severity":"high","exploited":false,"published_at":"2026-10-23T20:17:20.94+00:00","url":"https://junglewise.ai/threats/cve-2026-115572-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113795","cvss":4,"slug":"cve-2026-113795-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf memory exhaustion via crafted PDF streams","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:28.85+00:00","url":"https://junglewise.ai/threats/cve-2026-113795-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113794","cvss":4,"slug":"cve-2026-113794-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf infinite loop in PDF cross-reference table parsing","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:28.707+00:00","url":"https://junglewise.ai/threats/cve-2026-113794-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113793","cvss":4,"slug":"cve-2026-113793-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf infinite loop in cyclic PDF tree removal","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:27.327+00:00","url":"https://junglewise.ai/threats/cve-2026-113793-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113792","cvss":4,"slug":"cve-2026-113792-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf infinite loop in find_outline_item with cyclic PDF outline","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:27.173+00:00","url":"https://junglewise.ai/threats/cve-2026-113792-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113790","cvss":4,"epss":0.0032,"slug":"cve-2026-113790-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf resource exhaustion in PDF parsing","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:26.88+00:00","url":"https://junglewise.ai/threats/cve-2026-113790-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-113789","cvss":4,"epss":0.0032,"slug":"cve-2026-113789-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service via malicious form fields","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:26.603+00:00","url":"https://junglewise.ai/threats/cve-2026-113789-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-103000","cvss":4,"epss":0.003,"slug":"cve-2026-103000-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service in alphabetical page label processing","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:07.49+00:00","url":"https://junglewise.ai/threats/cve-2026-103000-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102999","cvss":4,"epss":0.003,"slug":"cve-2026-102999-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf repeated attachment parsing denial of service","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:07.343+00:00","url":"https://junglewise.ai/threats/cve-2026-102999-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102998","cvss":4,"epss":0.003,"slug":"cve-2026-102998-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service in appearance stream generation","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:07.177+00:00","url":"https://junglewise.ai/threats/cve-2026-102998-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102997","cvss":4,"epss":0.003,"slug":"cve-2026-102997-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service in FlateDecode decompression","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:07.02+00:00","url":"https://junglewise.ai/threats/cve-2026-102997-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102996","cvss":4,"epss":0.003,"slug":"cve-2026-102996-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf excessive memory consumption via TrueType/Type1 font /Widths","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:06.863+00:00","url":"https://junglewise.ai/threats/cve-2026-102996-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102995","cvss":4,"epss":0.003,"slug":"cve-2026-102995-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf memory exhaustion in ToUnicode font mapping parsing","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:06.713+00:00","url":"https://junglewise.ai/threats/cve-2026-102995-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102994","cvss":4,"epss":0.003,"slug":"cve-2026-102994-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service in PDF object token parsing","severity":"high","exploited":false,"published_at":"2026-09-30T20:17:28.08+00:00","url":"https://junglewise.ai/threats/cve-2026-102994-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-102993","cvss":4,"epss":0.003,"slug":"cve-2026-102993-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service via crafted PDF page labels","severity":"high","exploited":false,"published_at":"2026-09-30T20:17:27.63+00:00","url":"https://junglewise.ai/threats/cve-2026-102993-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-71870","cvss":4,"epss":0.0018,"slug":"cve-2026-71870-pypdf-uncontrolled-resource-consumption-in-tounicode-streams","title":"pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.","severity":"medium","exploited":false,"published_at":"2026-08-07T20:16:52.873+00:00","url":"https://junglewise.ai/threats/cve-2026-71870-pypdf-uncontrolled-resource-consumption-in-tounicode-streams"},{"cve":"CVE-2026-71852","cvss":4,"epss":0.0018,"slug":"cve-2026-71852-pypdf-excessive-iteration-in-cid-font-width-parsing","title":"pypdf excessive iteration in CID font width parsing","severity":"medium","exploited":false,"published_at":"2026-08-07T19:18:54.547+00:00","url":"https://junglewise.ai/threats/cve-2026-71852-pypdf-excessive-iteration-in-cid-font-width-parsing"},{"cve":"CVE-2026-57204","cvss":4,"epss":0.0037,"slug":"cve-2026-57204-py-pdf-pypdf-denial-of-service-via-uncontrolled-memory","title":"py-pdf pypdf denial of service via uncontrolled memory consumption","severity":"medium","exploited":false,"published_at":"2026-06-30T22:16:57.7+00:00","url":"https://junglewise.ai/threats/cve-2026-57204-py-pdf-pypdf-denial-of-service-via-uncontrolled-memory"},{"cve":"CVE-2026-41314","cvss":6.5,"epss":0.0023,"slug":"cve-2026-41314-pypdf-manipulated-flatedecode-image-dimensions-can-exhaust-ram","title":"PYSEC-2026-3026 - pypdf: Manipulated FlateDecode image dimensions can exhaust RAM","severity":"medium","exploited":false,"published_at":"2026-04-22T22:16:32.367+00:00","url":"https://junglewise.ai/threats/cve-2026-41314-pypdf-manipulated-flatedecode-image-dimensions-can-exhaust-ram"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Py-Pdf Pypdf","slug":"py-pdf-pypdf","vendor":{"hub":true,"name":"Py-Pdf","slug":"py-pdf","url":"https://junglewise.ai/threats/vendors/py-pdf"},"aliases":[],"category":"library","homepage":"https://github.com/py-pdf/pypdf","repo_url":"https://github.com/py-pdf/pypdf","description":"Python library for reading, writing, and manipulating PDF documents.","url":"https://junglewise.ai/threats/technologies/py-pdf-pypdf"},"most_severe":[{"cve":"CVE-2026-33699","cvss":7.5,"epss":0.0047,"slug":"cve-2026-33699-pypdf-possible-infinite-loop-during-recovery-attempts-in","title":"PYSEC-2026-3012 - pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream","severity":"high","exploited":false,"published_at":"2026-03-27T01:16:19.147+00:00","url":"https://junglewise.ai/threats/cve-2026-33699-pypdf-possible-infinite-loop-during-recovery-attempts-in"},{"cve":"CVE-2026-27888","cvss":7.5,"epss":0.004,"slug":"cve-2026-27888-pypdf-manipulated-flatedecode-xfa-streams-can-exhaust-ram","title":"PYSEC-2026-3027 - pypdf: Manipulated FlateDecode XFA streams can exhaust RAM","severity":"high","exploited":false,"published_at":"2026-02-26T01:16:25.47+00:00","url":"https://junglewise.ai/threats/cve-2026-27888-pypdf-manipulated-flatedecode-xfa-streams-can-exhaust-ram"},{"cve":"CVE-2026-27628","cvss":7.5,"epss":0.004,"slug":"cve-2026-27628-pypdf-infinite-loop-in-circular-cross-reference-streams","title":"PYSEC-2026-3005 - pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams","severity":"high","exploited":false,"published_at":"2026-02-25T03:16:06.513+00:00","url":"https://junglewise.ai/threats/cve-2026-27628-pypdf-infinite-loop-in-circular-cross-reference-streams"},{"cve":"CVE-2026-115585","cvss":4,"epss":0.0053,"slug":"cve-2026-115585-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf incomplete remediation causing excessive PDF stream reloads","severity":"high","exploited":false,"published_at":"2026-10-23T20:17:21.23+00:00","url":"https://junglewise.ai/threats/cve-2026-115585-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-115572","cvss":4,"epss":0.0053,"slug":"cve-2026-115572-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf repeated PDF object reference denial of service","severity":"high","exploited":false,"published_at":"2026-10-23T20:17:20.94+00:00","url":"https://junglewise.ai/threats/cve-2026-115572-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119207","cvss":4,"epss":0.003,"slug":"cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf excessive memory consumption in strict mode PDF parsing","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.953+00:00","url":"https://junglewise.ai/threats/cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119206","cvss":4,"epss":0.003,"slug":"cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service via crafted page labels","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.817+00:00","url":"https://junglewise.ai/threats/cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119205","cvss":4,"epss":0.003,"slug":"cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf infinite loop in DictionaryObject cloning","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.677+00:00","url":"https://junglewise.ai/threats/cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-119204","cvss":4,"epss":0.003,"slug":"cve-2026-119204-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf excessive memory consumption in PDF page tree parsing","severity":"high","exploited":false,"published_at":"2026-10-29T21:17:19.527+00:00","url":"https://junglewise.ai/threats/cve-2026-119204-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"},{"cve":"CVE-2026-103000","cvss":4,"epss":0.003,"slug":"cve-2026-103000-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to","title":"pypdf denial of service in alphabetical page label processing","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:07.49+00:00","url":"https://junglewise.ai/threats/cve-2026-103000-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}