CVE-2026-71852
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption
CVSS
3.3
Low
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Aug 7, 2026 · Last modified: Oct 24, 2026 · CWE-834
0.1%EPSS · 30 days0.2%
2026-09-272026-10-25
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-115580—34.9%
——10pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.2dCVE-2026-90798—48.2%
——14A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.5dCVE-2026-1105965.5 MED5.5%
——2quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.6dCVE-2026-1092996.5 MED31.3%
——9Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.2dCVE-2026-1065765.3 MED36.6%
——11ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.17dCVE-2026-91137—20.0%
——6Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.24d