CVE-2026-22690 | BDVDB-2026-309971 Detail

Description#

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-01-10Record published in the CVE List.
2. Version 22026-01-12Most recent update recorded in the CVE List.