Most recent entries from all

BREW-pdfalyzer-CVE-2026-40260 — pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

2026-10-03T06:23:19.842588+00:00

Affected: Homebrew: pdfalyzer

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

### Patches This has been fixed in [pypdf==6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0).

### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3724](https://github.com/py-pdf/pypdf/pull/3724).

CVE-2026-40260 — pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

2026-10-03T06:23:19.842647+00:00

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.

GHSA-3crg-w4f6-42mx — pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

2026-10-03T06:23:19.842677+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

### Patches This has been fixed in [pypdf==6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0).

### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3724](https://github.com/py-pdf/pypdf/pull/3724).