Veille CVE

Mardi 1 septembre 2026

4 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « py-pdf pypdf » ✕
  1. CVE-2026-84311 3.3 Faible

    py-pdf pypdf · Pypdf project pypdf

    pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

  2. CVE-2026-84310 3.3 Faible

    py-pdf pypdf · Pypdf project pypdf

    pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

  3. CVE-2026-84309 5.5 Moyenne

    py-pdf pypdf · Pypdf project pypdf

    pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

  4. CVE-2026-82398 5.3 Moyenne

    py-pdf pypdf · Pypdf project pypdf

    pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.