https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T18:46:58.526797+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-71870 CVE-2026-71870 — pypdf: Possible large memory usage for large /ToUnicode streams 2026-09-29T18:46:58.528660+00:00

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

 https://db.gcve.eu/vuln/ghsa-fp3f-mc75-235c GHSA-fp3f-mc75-235c — pypdf: Possible large memory usage for large /ToUnicode streams 2026-09-29T18:46:58.528780+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction.

### Patches

This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3944](https://github.com/py-pdf/pypdf/pull/3944).

 https://db.gcve.eu/vuln/pysec-2026-3655 PYSEC-2026-3655 — pypdf: Possible large memory usage for large /ToUnicode streams 2026-09-29T18:46:58.528828+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction.

### Patches

This has been fixed in [pypdf==6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3944](https://github.com/py-pdf/pypdf/pull/3944).