CVE-2026-22691 — Vulnerability intelligence
py-pdf — pypdf
Published:
- CVSS
- 2.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.