CVE-2026-22691: pypdf has possible long runtimes for malformed startxref
Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.
Patches This has been fixed in pypdf==6.6.0.
Workarounds
python from pypdf import PdfReader, PdfWriter
Instead of reader = PdfReader("file.pdf") use the strict mode: reader = PdfReader("file.pdf", strict=True)
Instead of writer = PdfWriter(clonefrom="file.pdf") use an explicit strict reader: writer = PdfWriter(clonefrom=PdfReader("file.pdf", strict=True))
Resources This issue has been fixed in #3594.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22691?
CVE-2026-22691 has a moderate severity due to potential long runtimes caused by malformed PDF startxref entries.
How do I fix CVE-2026-22691?
To fix CVE-2026-22691, upgrade to pypdf version 6.6.0 or higher.
What versions of pypdf are affected by CVE-2026-22691?
Versions of pypdf prior to 6.6.0 are affected by CVE-2026-22691.
What could happen if I don't address CVE-2026-22691?
If not addressed, CVE-2026-22691 could lead to performance issues due to long runtimes when processing malformed PDF files.
Is CVE-2026-22691 exploitable in all use cases of pypdf?
CVE-2026-22691 is exploitable when pypdf is used to parse or process crafted PDF files with invalid startxref entries.