Hi, The following vulnerabilities were published for pypdf. CVE-2026-115572[0]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.2, an attacker can craft a PDF that repeatedly references the | same nonexistent indirect object, causing relevant file parts such | as pages to trigger repeated full-file recovery loads and long | runtimes when accessed. This issue is fixed in version 6.21.2. CVE-2026-115580[1]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.2, an attacker can craft a PDF with a standard cross-reference | table whose declared entry count exceeds what the file can contain, | causing excessive processing and long runtimes when the file is | opened. This issue is fixed in version 6.21.2. CVE-2026-115585[2]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.2, an incomplete remediation for repeated malformed cross- | reference entries in GHSA-55h5-xmcq-c37v could still trigger a | complete PDF stream reload during each recovery attempt even when a | recovery cache was present, causing crafted cross-reference streams | to produce long runtimes. This issue is fixed in version 6.21.2. CVE-2026-119203[3]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.4, pypdf can enter an infinite loop while opening a crafted | incomplete PDF whose standard cross-reference table reaches the end | of the file without a trailer. The trailer search can repeatedly | rewind to the same stream position instead of terminating when | parsing makes no progress, blocking the processing thread. This | issue is fixed in version 6.21.4. CVE-2026-119204[4]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.4, pypdf can consume excessive memory while parsing a crafted | PDF page tree containing many shared resources. Page-tree flattening | copies page dictionary and inherited resource entries without a | document-wide entry budget, allowing the crafted resource structure | to cause disproportionate allocations. This issue is fixed in | version 6.21.4. CVE-2026-119205[5]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.4, pypdf can enter an infinite loop when cloning or duplicating | a crafted cyclic DictionaryObject. Clone traversal checked generated | destination references rather than the original source references, | allowing some source cycles to evade the visited-object check. This | issue is fixed in version 6.21.4. CVE-2026-119206[6]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.3, pypdf can take excessive time to retrieve page labels from a | crafted PDF containing a flat page-label number tree with many | ranges. The page_labels property resolves each page independently | and repeatedly scans the same /Nums array from the beginning, | causing work to grow with both the page count and the number of | label ranges. This issue is fixed in version 6.21.3. CVE-2026-119207[7]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.3, pypdf can consume excessive memory when strict mode loads a | crafted invalid PDF dictionary. Nested parsing failures add repeated | exception text to newly raised errors, allowing a small malformed | dictionary to amplify into very large error messages. This issue is | fixed in version 6.21.3. CVE-2026-119208[8]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.3, pypdf can consume excessive time and memory when an | application accesses the page count of a crafted encrypted PDF whose | page tree declares a forged /Count value. Even after successful | decryption, page-count retrieval trusts the unvalidated declared | count instead of walking the page tree, allowing the attacker- | controlled value to drive excessive work and memory use. This issue | is fixed in version 6.21.3. CVE-2026-119209[9]: | pypdf is a free and open-source pure-python PDF library. Prior to | 6.21.3, pypdf can consume excessive memory while opening a crafted | PDF containing cross-reference streams that declare very large entry | counts. Highly compressible streams and /Prev chains can multiply | the number of parsed entries across a document, while negative | /Index counts can bypass the existing per-stream clamp. This issue | is fixed in version 6.21.3. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115572 https://www.cve.org/CVERecord?id=CVE-2026-115572 [1] https://security-tracker.debian.org/tracker/CVE-2026-115580 https://www.cve.org/CVERecord?id=CVE-2026-115580 [2] https://security-tracker.debian.org/tracker/CVE-2026-115585 https://www.cve.org/CVERecord?id=CVE-2026-115585 [3] https://security-tracker.debian.org/tracker/CVE-2026-119203 https://www.cve.org/CVERecord?id=CVE-2026-119203 [4] https://security-tracker.debian.org/tracker/CVE-2026-119204 https://www.cve.org/CVERecord?id=CVE-2026-119204 [5] https://security-tracker.debian.org/tracker/CVE-2026-119205 https://www.cve.org/CVERecord?id=CVE-2026-119205 [6] https://security-tracker.debian.org/tracker/CVE-2026-119206 https://www.cve.org/CVERecord?id=CVE-2026-119206 [7] https://security-tracker.debian.org/tracker/CVE-2026-119207 https://www.cve.org/CVERecord?id=CVE-2026-119207 [8] https://security-tracker.debian.org/tracker/CVE-2026-119208 https://www.cve.org/CVERecord?id=CVE-2026-119208 [9] https://security-tracker.debian.org/tracker/CVE-2026-119209 https://www.cve.org/CVERecord?id=CVE-2026-119209 Regards, Salvatore