Summary
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Advisory details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
- MEDIUMCVE-2026-53493
Containerd has image-pull DoS via crafted OCI index graph amplification
- MEDIUMCVE-2026-84310
pypdf: Possible long runtimes/large memory usage when retrieving outlines
- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- MEDIUMCVE-2026-96628
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CRITICALCVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport