{"id":"openSUSE-SU-2026:22188-1","summary":"Security update for python-pypdf","details":"This update for python-pypdf fixes the following issues:\n\nChanges in python-pypdf:\n\n- CVE-2026-113786: PDF containing image data labeled with the\n  `/DCTDecode` filter causes Pillow to select and invoke an\n  unintended image parser when the image is loaded (bsc#1286632)\n- CVE-2026-113789: crafted PDF causes large memory usage or long\n  runtimes when an application retrieves the document's form fields\n  (bsc#1286633)\n- CVE-2026-113790: PDF containing arrays or dictionaries with many\n  elements causes parsing to consume large amounts of memory\n  (bsc#1286634)\n- CVE-2026-113791: PDF containing a content stream with many small\n  operations causes parsing to consume large amounts of memory\n  (bsc#1286635)\n- CVE-2026-113792: calling `PdfWriter.find_outline_item` on a\n  crafted PDF with a cyclic outline hierarchy can enter an infinite\n  loop and block the current process (bsc#1286636)\n- CVE-2026-113793: removing an object from a crafted cyclic PDF\n  tree can enter an infinite loop and block the current process\n  (bsc#1286637)\n- CVE-2026-113794: incomplete PDF that ends inside a standard\n  cross-reference table causes pypdf to mishandle the unexpected\n  end of file and enter an infinite loop (bsc#1286638)\n- CVE-2026-113795: accessing a crafted PDF stream with a large\n  number of filters or multiple filters that pass around large\n  amounts of data can cause large memory consumption (bsc#1286639)\n","modified":"2026-11-01T17:23:29.513373666Z","published":"2026-10-26T15:02:57Z","related":["CVE-2026-113786","CVE-2026-113789","CVE-2026-113790","CVE-2026-113791","CVE-2026-113792","CVE-2026-113793","CVE-2026-113794","CVE-2026-113795"],"upstream":["CVE-2026-113786","CVE-2026-113789","CVE-2026-113790","CVE-2026-113791","CVE-2026-113792","CVE-2026-113793","CVE-2026-113794","CVE-2026-113795"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286632"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286633"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286634"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286635"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286636"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286637"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286638"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286639"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113786"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113789"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113790"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113791"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113792"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113793"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113794"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-113795"}],"affected":[{"package":{"name":"python-pypdf","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/python-pypdf&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.0-bp160.2.1"}]}],"ecosystem_specific":{"binaries":[{"python313-pypdf":"6.19.0-bp160.2.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22188-1.json"}}],"schema_version":"1.9.2"}