~ / search / GHSA-jj6c-8h6c-hppx

GHSA-jj6c-8h6c-hppx

pypdf has long runtimes for wrong size values in cross-reference and object streams

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-41168

Packages

EcosystemPackageAffectedFixed in
PyPI pypdf < 6.10.1 6.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3733](https://github.com/py-pdf/pypdf/pull/3733).

References

External links from the advisory. They lead to third-party sites.