Your message dated Wed, 30 Sep 2026 12:19:11 +0000
with message-id <[email protected]>
and subject line Bug#1146476: fixed in pypdf 6.19.0-1
has caused the Debian Bug report #1146476,
regarding pypdf: CVE-2026-82398 CVE-2026-84310 CVE-2026-84311
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146476: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146476
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pypdf
Version: 6.9.2-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for pypdf.
CVE-2026-82398[0]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.15.0, an attacker can craft a PDF that causes long runtimes when
| the pypdf/_utils.py function read_until_whitespace reads a stream
| containing a long run of bytes without whitespace. The function
| repeatedly performs immutable bytes concatenation in a one-byte
| loop, causing quadratic processing cost for the long non-whitespace
| input. This issue is fixed in version 6.15.0.
CVE-2026-84310[1]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py
| _get_outline to consume long runtimes and large amounts of memory
| when retrieving document outlines with large numbers of entries or
| deeply nested reused paths because the traversal lacked global
| entry-count and nesting-depth limits. This issue is fixed in version
| 6.16.1.
CVE-2026-84311[2]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py
| PageObject._extract_text and PageObject.extract_xform_text to
| traverse a directed acyclic graph of reused form XObjects in which
| each form invokes a child multiple times, creating exponentially
| many traversal paths and causing long runtimes and large memory
| consumption. This issue is fixed in version 6.16.1.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-82398
https://www.cve.org/CVERecord?id=CVE-2026-82398
[1] https://security-tracker.debian.org/tracker/CVE-2026-84310
https://www.cve.org/CVERecord?id=CVE-2026-84310
[2] https://security-tracker.debian.org/tracker/CVE-2026-84311
https://www.cve.org/CVERecord?id=CVE-2026-84311
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: pypdf
Source-Version: 6.19.0-1
Done: Pieter Lenaerts <[email protected]>
We believe that the bug you reported is fixed in the latest version of
pypdf, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Pieter Lenaerts <[email protected]> (supplier of updated pypdf package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 29 Sep 2026 22:40:33 +0200
Source: pypdf
Architecture: source
Version: 6.19.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Pieter Lenaerts <[email protected]>
Closes: 1134731 1134733 1134736 1134737 1134738 1138192 1138193 1138194 1140629
1141339 1141771 1143902 1146476 1146638
Changes:
pypdf (6.19.0-1) unstable; urgency=medium
.
* New version 6.19.0
(Closes: 1134731, 1134733, 1134736, 1134737, 1134738, 1138192, 1138193,
1138194, 1140629, 1141339, 1141771, 1143902, 1146476, 1146638)
* Refresh patches
* debian/patches/0001-Use-formal-Cryptodome-namespace.patch: add unpad to
import
* d/control:
- New build deps for tests
- Bump debhelper-compat to 14, remove obsolete substvars
- Switch python3-flit to flit build-dep
- Enable dh-sequence-single-binary
- Add suggests for some dependencies
* d/copyright, d/patches/0004-replace-old-unicode-license.patch,
debian/source/lintian-overrides:
fix lintian tag license-problem-old-unicode
Checksums-Sha1:
f7993119857d87820da0a0c986713ff04b3f5e6b 2365 pypdf_6.19.0-1.dsc
bb11e87bcf8bc040f49eafa2928e06c6ee7507d3 8459308 pypdf_6.19.0.orig.tar.xz
fde600cd380fd4a09e02c22bd9ef47af048b17f2 13136 pypdf_6.19.0-1.debian.tar.xz
e14620cc2d007e3497db3291fa2a2338d291d60d 9795 pypdf_6.19.0-1_source.buildinfo
Checksums-Sha256:
4b82faf852bbff61dfdaf4c5b2af689c9de55e3626a8b8a7b21d40e53f39ff23 2365
pypdf_6.19.0-1.dsc
f4b8092a6c99c3864415ada7f5e0b895b3eff865b6b6398e0053b31fc0827e19 8459308
pypdf_6.19.0.orig.tar.xz
e3f37ae43b4484a99f8e746d8860d53d178d8ba09957f3a67d61aa9a73c40efa 13136
pypdf_6.19.0-1.debian.tar.xz
9a9a5355164c5d4f9f66c25a992e48178f1272425c20a66d969da28c9103516b 9795
pypdf_6.19.0-1_source.buildinfo
Files:
e7c6259773a683a0107636e704cbfc57 2365 python optional pypdf_6.19.0-1.dsc
4a1a8b24694efc42f8182d67453bb828 8459308 python optional
pypdf_6.19.0.orig.tar.xz
cac1b8b1526d6d22cc678c28482c98ab 13136 python optional
pypdf_6.19.0-1.debian.tar.xz
319c778fcde7cd1de2ca56cf4cf5a134 9795 python optional
pypdf_6.19.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmq8+gkACgkQMfMURUSh
dBobGw//STjUQHUWSfdjEePAk+sUFw/Eeu0BmhB1iP9eveMmad5TRp8xEYXTviNZ
PB76+deIPqtK0fXb62YukT9uRvf7UTcoMKJ5PUtz+UIWr/n5BuSb6bFJefy0Krjc
F56j4dnhUW3M/49PbFLRNqoir9nnXYSSCEEowWdFpBqsm6eBWgsLyQ1cwVoCF/x0
xpBrqMNJTO/82bHrkYjNmCqXIsR0Uco0tE+DmDUxqpBU4q7yKgYn3KHiVGWNcexB
oI+2Lzs8r7l03DNsrhkKDhdnuNE//kzikLc551x0J8yeY/HYfxK2iqlFzVmWPJ5k
lWKJywnx4DInWQMASnyJx+aOKSLQ7jzv4MJ7/RwUsNdkMz4CXe/Me/N/d0vsXibb
bkSaXpXadLcSnJdfVVKau9rqqeyAfpCmDgWKrTXl7+RsoPmXAnejHVQbcA+IBUpn
8H5pFWR372PBfmI6M1XxQIZ9AoMS8HS3P6GogJ0Cs3gCFB0YUmJAAtioNW9f3RfI
fFxBDRAyABFfymBwZD6CjZ/iS+nR8uoMYWIFcA5LGHakHPjeElMTxEbAsnHsfjdV
w4G6lUBIr+38VYWvH2j6mJdBhds1kBUPginLKHwbpeSbGklqTD4+Hmn4iPxFJ7Lh
IbJjZvQNHiRbRjAJggpUe85945VZJDdHWbrO2Dasc3sC2iJeYGM=
=m1GQ
-----END PGP SIGNATURE-----
pgp_fMrqEzhHn.pgp
Description: PGP signature
--- End Message ---
