{"id":"openSUSE-SU-2026:22219-1","summary":"Security update for python-pypdf","details":"This update for python-pypdf fixes the following issues:\n\nChanges in python-pypdf:\n\n- CVE-2026-119209: negative /Index values and multiplied xref\n  streams can lead to clamp bypass and server memory exhaustion\n  (bsc#1288950)\n- CVE-2026-119208: trusting forged /Count values in encrypted PDF\n  page trees can lead to excessive resource consumption and denial\n  of service (bsc#1288951)\n- CVE-2026-119207: nested exception text accumulation in strict\n  mode parsing can lead to memory amplification and application\n  denial of service (bsc#1288952)\n- CVE-2026-119206: repeated sequential /Nums scanning in\n  page_labels resolution can lead to algorithmic complexity attacks\n  and denial of service (bsc#1288944)\n- CVE-2026-119205: misdirected reference tracking during dictionary\n  cloning can lead to cycle-detection bypass and thread-hanging\n  infinite loops (bsc#1288943)\n- CVE-2026-119204: unbounded resource entry copying during\n  page-tree flattening can lead to excessive memory allocation and\n  denial of service (bsc#1288942)\n- CVE-2026-119203: unterminated trailer search in incomplete\n  cross-reference tables can lead to an infinite loop and\n  thread-blocking denial of service (bsc#1288941)\n","modified":"2026-11-04T17:23:23.818444116Z","published":"2026-11-02T16:47:23Z","related":["CVE-2026-119203","CVE-2026-119204","CVE-2026-119205","CVE-2026-119206","CVE-2026-119207","CVE-2026-119208","CVE-2026-119209"],"upstream":["CVE-2026-119203","CVE-2026-119204","CVE-2026-119205","CVE-2026-119206","CVE-2026-119207","CVE-2026-119208","CVE-2026-119209"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288941"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288942"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288943"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288944"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288950"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288951"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288952"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119203"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119204"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119205"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119206"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119207"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119208"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119209"}],"affected":[{"package":{"name":"python-pypdf","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/python-pypdf&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.0-bp160.3.1"}]}],"ecosystem_specific":{"binaries":[{"python313-pypdf":"6.19.0-bp160.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22219-1.json"}}],"schema_version":"1.9.2"}