Staging Environment: Content and features may be unstable or change without notice.

Advisory Severity Curation

GHSA-7gw9-cf7v-778f

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-7gw9-cf7v-778f

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM ### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. ### Patches This has been fixed in pypdf==6.10.2 https://github.com/py-pdf/pypdf/releases/tag/6.10.2. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3734 https://github.com/py-pdf/pypdf/pull/3734.

gitlab/pypi/pypdf/CVE-2026-41312

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters.

gitlab/pypi/pypdf/GHSA-7gw9-cf7v-778f

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters.

pypa/pypdf/PYSEC-2026-3011

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM ### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. ### Patches This has been fixed in pypdf==6.10.2 https://github.com/py-pdf/pypdf/releases/tag/6.10.2. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3734 https://github.com/py-pdf/pypdf/pull/3734.

pysec/PYSEC-2026-3011

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM ### Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. ### Patches This has been fixed in pypdf==6.10.2 https://github.com/py-pdf/pypdf/releases/tag/6.10.2. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3734 https://github.com/py-pdf/pypdf/pull/3734.