Most recent entries from all

CVE-2026-22691 — pypdf has possible long runtimes for malformed startxref

2026-09-29T03:09:09.178056+00:00

Affected: py-pdf pypdf

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

GHSA-4f6g-68pf-7vhv — pypdf has possible long runtimes for malformed startxref

2026-09-29T03:09:09.178238+00:00

Affected: PyPI: pypdf

### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python from pypdf import PdfReader, PdfWriter

# Instead of reader = PdfReader("file.pdf") # use the strict mode: reader = PdfReader("file.pdf", strict=True)

# Instead of writer = PdfWriter(clone_from="file.pdf") # use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ```

### Resources This issue has been fixed in #3594.

PYSEC-2026-1828 — pypdf has possible long runtimes for malformed startxref