unstale

pypi / pypdf

pypdf

What changed in pypdf 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

52 security1 new APIs and options4 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

pypdf 657 changes

Security 52

  • Only /DCTDecode image data is opened with the Pillow JPEG plugin.

    6.21.1release notes

  • Improves performance and limits field work.

    6.21.0release notes

  • Limits stream parsing work.

    6.21.0release notes

  • Prevents cyclic tree handling.

    6.20.1release notes

  • pypdf: Possible large memory usage when retrieving alphabetical page labels

    6.19.0security advisory

  • pypdf: Possible long runtimes when generating appearance streams

    6.19.0security advisory

  • pypdf: Possible long runtimes with large amount of embedded files

    6.19.0security advisory

  • pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

    6.18.1security advisory

  • pypdf: Possible large memory usage when parsing font data

    6.18.1security advisory

  • pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

    6.18.1security advisory

  • pypdf: Possible long runtimes/large memory usage when parsing indirect objects

    6.18.0security advisory

  • pypdf: Possible large memory usage when retrieving Roman page labels

    6.17.0security advisory

  • pypdf: Possible long runtimes/large memory usage when extracting XForm objects

    6.16.1security advisory

  • pypdf: Possible long runtimes/large memory usage when retrieving outlines

    6.16.1security advisory

  • pypdf: Possible infinite loop for TreeObject.insert_child

    6.16.0security advisory

  • pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

    6.15.0security advisory

  • pypdf: Possible large memory usage for large /ToUnicode streams

    6.15.0security advisory

  • pypdf: Possible long runtimes/large memory usage for large CID font width ranges

    6.15.0security advisory

  • pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

    6.14.2security advisory

  • pypdf: Possible infinite loop for not terminated inline images

    6.14.1security advisory

  • pypdf: Possible large memory usage for wrong image dimensions

    6.14.0security advisory

  • pypdf: Possible long runtimes for repeated malformed cross-reference entries

    6.14.0security advisory

  • pypdf: Missing stream length values ignore defined limits

    6.13.3security advisory

  • pypdf: Possible infinite loop when processing threads/articles in writer

    6.13.1security advisory

  • pypdf: Possible infinite loop when processing outlines/bookmarks in writer

    6.13.0security advisory

  • pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

    6.13.0security advisory

  • pypdf: Inefficient decoding of FlateDecode PNG predictor streams

    6.12.2security advisory

  • pypdf: Possible large memory usage for form XObjects during text extraction

    6.12.2security advisory

  • pypdf: Manipulated XMP metadata streams can exhaust RAM

    6.12.1security advisory

  • pypdf: Possible large memory usage for large offsets for layout mode text

    6.12.0security advisory

  • pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

    6.12.0security advisory

  • pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

    6.10.2security advisory

  • pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

    6.10.2security advisory

  • pypdf: Possible long runtimes for wrong size values in incremental mode

    6.10.2security advisory

  • pypdf has long runtimes for wrong size values in cross-reference and object streams

    6.10.1security advisory

  • pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

    6.10.0security advisory

  • pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

    6.9.2security advisory

  • pypdf has inefficient decoding of array-based streams

    6.9.1security advisory

  • pypdf: manipulated stream length values can exhaust RAM

    6.8.0security advisory

  • pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

    6.7.5security advisory

  • pypdf: Manipulated RunLengthDecode streams can exhaust RAM

    6.7.4security advisory

  • pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

    6.7.3security advisory

  • pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

    6.7.2security advisory

  • pypdf has a possible infinite loop when processing TreeObject

    6.7.1security advisory

  • pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

    6.7.1security advisory

  • pypdf possibly has long runtimes for malformed FlateDecode streams

    6.7.1security advisory

  • pypdf has possible Infinite Loop when processing outlines/bookmarks

    6.6.2security advisory

  • pypdf has possible long runtimes for malformed startxref

    6.6.0security advisory

  • pypdf has possible long runtimes for missing /Root object with large /Size values

    6.6.0security advisory

  • pypdf's LZWDecode streams be manipulated to exhaust RAM

    6.4.0security advisory

  • pypdf can exhaust RAM via manipulated LZWDecode streams

    6.1.3security advisory

  • pypdf possibly loops infinitely when reading DCT inline images without EOF marker

    6.1.3security advisory

New APIs and options 1

  • Allows custom fit modes for named destinations.

    6.21.0release notes

Fixes and other changes 4

  • Avoids overwriting unread objects in add_form_topname.

    6.21.0release notes

  • Treats NUL as whitespace in ArrayObject.

    6.21.0release notes

  • Reads an indirect page box on a writer page.

    6.21.0release notes

  • Only reads the color operator from a text field's default appearance.

    6.20.1release notes