mediumVulnerability
GHSA-jj6c-8h6c-hppx
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. ### Patches This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3733](https://github.com/py-pdf/pypdf/pull/3733).
Properties
- ghsa_id
- GHSA-jj6c-8h6c-hppx
- severity
- medium
- summary
- pypdf has long runtimes for wrong size values in cross-reference and object streams
- cve_id
- GHSA-jj6c-8h6c-hppx
- is_ghsa_only
- true
- ghsa_published
- 2026-04-15T19:43:09Z
- source_url
- https://github.com/advisories/GHSA-jj6c-8h6c-hppx
- ghsa_updated
- 2026-04-15T19:43:10Z
Related Entities (4)
AFFECTS (1)
→[Software]pip/pypdf
HAS_WEAKNESS (1)
→[Weakness]Excessive Iteration
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]pip/pypdf
Explore deeper with Ninja Signal's threat intelligence graph