pypdf: Possible long runtimes for repeated references to the same missing object

높음 7.1CVE-2026-115572 · GHSA-6c7f-9265-g8fw · Published 23/10/2026 · updated 26/10/2026

요약

CVE-2026-115572은(는) pypdf에 영향을 주는 높음 (CVSS 7.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.38%, 전체 취약점의 31.5%보다 높음.
조치: 6.21.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.2`	`6.21.2`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4240.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.

References

pypdf의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pypdf

PyPI

< 6.21.2

6.21.2