chore(deps): update dependency pypdf to v6.15.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	==6.14.2 → ==6.15.0

---

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

CVE-2026-71852 / GHSA-fwg2-594c-jp42

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3946.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42
• https://github.com/py-pdf/pypdf/pull/3946
• https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fwg2-594c-jp42

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large /ToUnicode streams

CVE-2026-71870 / GHSA-fp3f-mc75-235c

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction.

Patches

This has been fixed in pypdf==6.15.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3944.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c
• https://github.com/py-pdf/pypdf/pull/3944
• https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0
• https://github.com/advisories/GHSA-fp3f-mc75-235c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.15.0

Compare Source

Security (SEC)

• Improve performance of read_until_whitespace (#​3947)
• Limit CID width range and width count when loading fonts (#​3946)
• Limit token length for ToUnicode entries (#​3944)

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#​3897)

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#​3901)
• Allow keeping original PDF header in non-incremental clone mode (#​3918)
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#​3831)
• Add actions base class (#​3552)

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#​3938)
• Decode low-bit DeviceRGB images as RGB instead of palette (#​3929)
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#​3937)

Documentation (DOC)

• Image and attachment filenames are unsanitized (#​3942)

Maintenance (MAINT)

• Update charset mappings (#​3935)

Full Changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.