Staging Environment: Content and features may be unstable or change without notice.

Advisory Severity Curation

GHSA-jj6c-8h6c-hppx

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-jj6c-8h6c-hppx

pypdf has long runtimes for wrong size values in cross-reference and object streams ### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in pypdf==6.10.1 https://github.com/py-pdf/pypdf/releases/tag/6.10.1. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3733 https://github.com/py-pdf/pypdf/pull/3733.

gitlab/pypi/pypdf/CVE-2026-41168

pypdf has long runtimes for wrong size values in cross-reference and object streams An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values.

gitlab/pypi/pypdf/GHSA-jj6c-8h6c-hppx

pypdf has long runtimes for wrong size values in cross-reference and object streams An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values.

pypa/pypdf/PYSEC-2026-3021

pypdf has long runtimes for wrong size values in cross-reference and object streams ### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in pypdf==6.10.1 https://github.com/py-pdf/pypdf/releases/tag/6.10.1. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3733 https://github.com/py-pdf/pypdf/pull/3733.

pysec/PYSEC-2026-3021

pypdf has long runtimes for wrong size values in cross-reference and object streams ### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in pypdf==6.10.1 https://github.com/py-pdf/pypdf/releases/tag/6.10.1. ### Workarounds If you cannot upgrade yet, consider applying the changes from PR #3733 https://github.com/py-pdf/pypdf/pull/3733.