pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae Patch
- https://github.com/py-pdf/pypdf/pull/3887 Issue Tracking, Patch
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · pypdf_projectNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
References 4
- https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae Patch
- https://github.com/py-pdf/pypdf/pull/3887 Issue Tracking, Patch
- https://github.com/py-pdf/pypdf/releases/tag/6.14.0 Product, Release Notes
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v Patch, Vendor Advisory