Update dependency pypdf to v6.1.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
pypdf (changelog)	minor	==6.0.0 -> ==6.1.3

GitHub Vulnerability Alerts

CVE-2025-62708

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3502.

CVE-2025-62707

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3501.

---

pypdf can exhaust RAM via manipulated LZWDecode streams

CVE-2025-62708 / GHSA-jfx9-29x2-rv3j

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3502.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j
• https://nvd.nist.gov/vuln/detail/CVE-2025-62708
• https://github.com/py-pdf/pypdf/pull/3502
• https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

pypdf possibly loops infinitely when reading DCT inline images without EOF marker

CVE-2025-62707 / GHSA-vr63-x8vc-m265

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter.

Patches

This has been fixed in pypdf==6.1.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3501.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265
• https://nvd.nist.gov/vuln/detail/CVE-2025-62707
• https://github.com/py-pdf/pypdf/pull/3501
• https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.1.3

Compare Source

Security (SEC)

• Allow limiting size of LZWDecode streams (#​3502)
• Avoid infinite loop when reading broken DCT-based inline images (#​3501)

Bug Fixes (BUG)

• PageObject.scale() scales media box incorrectly (#​3489)

Robustness (ROB)

• Fail with explicit exception when image mode is an empty array (#​3500)

Full Changelog

v6.1.2

Compare Source

Security (SEC)

• Allow limiting size of LZWDecode streams (#​3502)
• Avoid infinite loop when reading broken DCT-based inline images (#​3501)

Bug Fixes (BUG)

• PageObject.scale() scales media box incorrectly (#​3489)

Robustness (ROB)

• Fail with explicit exception when image mode is an empty array (#​3500)

Full Changelog

v6.1.1

Compare Source

Bug Fixes (BUG)

• Fix handling of zero-length StreamObject (#​3485)

Robustness (ROB)

• Deal with wrong size for incremental PDF files (#​3495)
• Improve handling for malformed cross-reference tables (#​3483)

Developer Experience (DEV)

• Use released Python 3.14
• Use Mapping instead of dict in type hint of update_page_form_field_values (#​3490)

Full Changelog

v6.1.0

Compare Source

Bug Fixes (BUG)

• Insert new embedded files in a sorted manner (#​3477)
• Fix name tree handling for embedded files with Kids-based inputs (#​3475)
• Make embedding files not break PDF/A-3 compliance (#​3472)

Documentation (DOC)

• Document AFRelationship handling for PDF/A and provide constants (#​3478)

Full Changelog

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.