CVE-2026-22691

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Uncontrolled Resource Consumption pada pypdf project pypdf. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

Rincian

Terbit di NVD

10 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv mitigasi · advisory vendor
• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45 patch
• https://github.com/py-pdf/pypdf/pull/3594 issue tracking · patch
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0 release notes