Skip to content

fix(deps): Update security vulnerability in pypdf to v6.9.2 [SECURITY]#4300

Closed
utic-renovate[bot] wants to merge 1 commit intomainfrom
renovate/security-updates
Closed

fix(deps): Update security vulnerability in pypdf to v6.9.2 [SECURITY]#4300
utic-renovate[bot] wants to merge 1 commit intomainfrom
renovate/security-updates

Conversation

@utic-renovate
Copy link
Copy Markdown
Contributor

@utic-renovate utic-renovate Bot commented Mar 25, 2026

This PR contains the following updates:

Package Change Age Confidence
pypdf (changelog) 6.9.16.9.2 age confidence

GitHub Vulnerability Alerts

CVE-2026-33699

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #​3693.


Release Notes

py-pdf/pypdf (pypdf)

v6.9.2

Compare Source

Security (SEC)
  • Avoid infinite loop in read_from_stream for broken files (#​3693)
Robustness (ROB)
  • Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@lawrence-u10d
Copy link
Copy Markdown
Contributor

Closing to handle dependency update separately. Branch deleted so Renovate will recreate if needed.

@lawrence-u10d lawrence-u10d deleted the renovate/security-updates branch March 26, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant