pypdf has long runtimes for wrong size values in cross-reference and object streams

TRUNG BÌNH 5.3CVE-2026-41168 · GHSA-jj6c-8h6c-hppx · PYSEC-2026-3021 · Công bố 22/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-41168 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng pypdf, pypdf (pypdf project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.30%, cao hơn 22.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.10.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
pypdf PyPI	`< 6.10.1`	`6.10.1`
pypdf pypdf_project	`< 6.10.1`	`6.10.1`

Mô tả

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values.

Patches

This has been fixed in pypdf==6.10.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3733.

Mô tả của NVD

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.