⬆️(dependencies) update pypdf to v6.15.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	==6.14.2 → ==6.15.0

---

pypdf: Possible large memory usage for wrong image dimensions

CVE-2026-59938 / GHSA-5qjq-93h5-hrgp

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3888.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp
• https://nvd.nist.gov/vuln/detail/CVE-2026-59938
• https://github.com/py-pdf/pypdf/pull/3888
• https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a
• https://github.com/py-pdf/pypdf/releases/tag/6.14.0
• https://github.com/advisories/GHSA-5qjq-93h5-hrgp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes for repeated malformed cross-reference entries

CVE-2026-59937 / GHSA-55h5-xmcq-c37v

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.14.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3887.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v
• https://nvd.nist.gov/vuln/detail/CVE-2026-59937
• https://github.com/py-pdf/pypdf/pull/3887
• https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae
• https://github.com/py-pdf/pypdf/releases/tag/6.14.0
• https://github.com/advisories/GHSA-55h5-xmcq-c37v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

CVE-2026-71852 / GHSA-fwg2-594c-jp42

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3946.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42
• https://github.com/py-pdf/pypdf/pull/3946
• https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fwg2-594c-jp42

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large /ToUnicode streams

CVE-2026-71870 / GHSA-fp3f-mc75-235c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3944.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c
• https://github.com/py-pdf/pypdf/pull/3944
• https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fp3f-mc75-235c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.15.0

Compare Source

Security (SEC)

• Improve performance of read_until_whitespace (#​3947)
• Limit CID width range and width count when loading fonts (#​3946)
• Limit token length for ToUnicode entries (#​3944)

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#​3897)

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#​3901)
• Allow keeping original PDF header in non-incremental clone mode (#​3918)
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#​3831)
• Add actions base class (#​3552)

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#​3938)
• Decode low-bit DeviceRGB images as RGB instead of palette (#​3929)
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#​3937)

Documentation (DOC)

• Image and attachment filenames are unsanitized (#​3942)

Maintenance (MAINT)

• Update charset mappings (#​3935)

Full Changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/backend/uv.lock

Command failed: uv lock --upgrade-package pypdf
Using CPython 3.14.7 interpreter at: /opt/containerbase/tools/python/3.14.7/bin/python3
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version >= '3.14.6' and python_full_version < '3.15' and
  │ sys_platform == 'win32'):
  ╰─▶ Because there is no version of pypdf==6.15.0 and your project depends
      on pypdf==6.15.0, we can conclude that your project's requirements are
      unsatisfiable.
      And because your project requires conversations[dev], we can conclude
      that your project's requirements are unsatisfiable.

hint: The resolution failed for an environment that is not the current one, consider limiting the environments with `tool.uv.environments`.
hint: `pypdf` was filtered by `exclude-newer` to only include packages uploaded before 2026-08-04T15:00:08.410184132Z. The requested version, v6.15.0, was published at 2026-08-06T13:06:47.709Z. Consider using `exclude-newer-package` to override the cutoff for this package.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud