GitHub Advisoryadvisory · PyPI

GHSA-248m-82v9-q6g6 pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

MEDIUM Published 2026-06-12 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-48156
Ecosystem
PyPI
Packages
pypdf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-834
Reviewed
2026-06-12

Affected packages

• PyPI pypdf: < 6.12.0 → fixed in 6.12.0

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and large `/Size` values. Patches This has been fixed in pypdf==6.12.0. Workarounds If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #3791.

Related

Alias · CVE (1)

  • CVE-2026-48156 pypdf is a free and open-source pure-python PDF library. vulnerability

Weakness · CWE (1)

  • CWE-834 Excessive Iteration weakness

References