~ / search / GHSA-248m-82v9-q6g6

GHSA-248m-82v9-q6g6

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-48156

Packages

EcosystemPackageAffectedFixed in
PyPI pypdf < 6.12.0 6.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values. ### Patches This has been fixed in [pypdf==6.12.0](https://github.com/py-pdf/pypdf/releases/tag/6.12.0). ### Workarounds If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR [#3791](https://github.com/py-pdf/pypdf/pull/3791).

References

External links from the advisory. They lead to third-party sites.