logo

Database

Improper resource allocation In pypdf

Description

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #3791.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-481562. NVD-2026-481563. OSV-DEBIAN-2026-481564. OSV-2026-481565. GHSA-248m-82v9-q6g66. GCVE-2026-481567. SECURITY-TRACKER-CVE-2026-48156

References

1. https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g62. https://github.com/py-pdf/pypdf/pull/37913. https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da704. https://github.com/py-pdf/pypdf/releases/tag/6.12.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.