GitHub Advisoryadvisory · PyPI
GHSA-4xc4-762w-m6cg pypdf has possible long runtimes for missing /Root object with large /Size values
LOW
Official page ↗
- Aliases
- CVE-2026-22690
- Ecosystem
- PyPI
- Packages
- pypdf
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-400
- Reviewed
- 2026-01-09
Affected packages
• PyPI pypdf: < 6.6.0 → fixed in 6.6.0
Description
Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected.
Patches
This has been fixed in pypdf==6.6.0.
Workarounds
```python
from pypdf import PdfReader, PdfWriter
Instead of
reader = PdfReader("file.pdf")
use the strict mode:
reader = PdfReader("file.pdf", strict=True)
Instead of
writer = PdfWriter(clone_from="file.pdf")
use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```
Resources
This issue has been fixed in #3594.
Related
Alias · CVE (1)
- CVE-2026-22690 pypdf is a free and open-source pure-python PDF library. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg web
- https://nvd.nist.gov/vuln/detail/CVE-2026-22690 advisory
- https://github.com/py-pdf/pypdf/pull/3594 web
- https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45 web
- https://github.com/py-pdf/pypdf package
- https://github.com/py-pdf/pypdf/releases/tag/6.6.0 web