GitHub Advisoryadvisory · PyPI
GHSA-4f6g-68pf-7vhv pypdf has possible long runtimes for malformed startxref
LOW
Official page ↗
- Aliases
- CVE-2026-22691
- Ecosystem
- PyPI
- Packages
- pypdf
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-1333, CWE-400
- Reviewed
- 2026-01-09
Affected packages
• PyPI pypdf: < 6.6.0 → fixed in 6.6.0
Description
Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.
Patches
This has been fixed in pypdf==6.6.0.
Workarounds
```python
from pypdf import PdfReader, PdfWriter
Instead of
reader = PdfReader("file.pdf")
use the strict mode:
reader = PdfReader("file.pdf", strict=True)
Instead of
writer = PdfWriter(clone_from="file.pdf")
use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```
Resources
This issue has been fixed in #3594.
Related
Alias · CVE (1)
- CVE-2026-22691 pypdf is a free and open-source pure-python PDF library. vulnerability
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv web
- https://nvd.nist.gov/vuln/detail/CVE-2026-22691 advisory
- https://github.com/py-pdf/pypdf/pull/3594 web
- https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45 web
- https://github.com/py-pdf/pypdf package
- https://github.com/py-pdf/pypdf/releases/tag/6.6.0 web