CVE-2026-22690: pypdf has possible long runtimes for missing /Root object with large /Size values
Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected.
Patches This has been fixed in pypdf==6.6.0.
Workarounds
python from pypdf import PdfReader, PdfWriter
Instead of reader = PdfReader("file.pdf") use the strict mode: reader = PdfReader("file.pdf", strict=True)
Instead of writer = PdfWriter(clonefrom="file.pdf") use an explicit strict reader: writer = PdfWriter(clonefrom=PdfReader("file.pdf", strict=True))
Resources This issue has been fixed in #3594.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22690?
CVE-2026-22690 has a moderate severity as it can lead to long runtimes for invalid PDF files.
How do I fix CVE-2026-22690?
To fix CVE-2026-22690, upgrade pypdf to version 6.6.0 or later.
What types of files are affected by CVE-2026-22690?
CVE-2026-22690 affects PDF files processed by versions of pypdf prior to 6.6.0.
Can exploitation of CVE-2026-22690 lead to system issues?
Yes, exploitation of CVE-2026-22690 can cause long processing times which may affect system performance.
Who is at risk from CVE-2026-22690?
Users and applications that utilize the pypdf library prior to version 6.6.0 are at risk from CVE-2026-22690.