GitHub Advisoryadvisory · PyPI

GHSA-jj6c-8h6c-hppx pypdf has long runtimes for wrong size values in cross-reference and object streams

MEDIUM Published 2026-04-15 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-41168
Ecosystem
PyPI
Packages
pypdf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-834
Reviewed
2026-04-15

Affected packages

• PyPI pypdf: < 6.10.1 → fixed in 6.10.1

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. Patches This has been fixed in pypdf==6.10.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR #3733.

Related

Alias · CVE (1)

  • CVE-2026-41168 pypdf is a free and open-source pure-python PDF library. vulnerability

Weakness · CWE (1)

  • CWE-834 Excessive Iteration weakness

References