GHSA-6c7f-9265-g8fw: Pip/pypdf vulnerability

Q: What conditions are required to trigger the long runtime?

An attacker must supply a crafted PDF and cause the application to load relevant parts of that file, such as its pages. The PDF repeatedly references the same indirect object even though that object does not exist.

Q: Which pypdf release fixes the issue?

The issue is fixed in pypdf version 6.21.2.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4240 as a workaround.

Published Oct 23, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4240.

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.2

6.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2

Event History

Oct 23, 2026

Advisory Published

via GitHub·08:55 PM

Data Sourced

via GitHub·08:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What conditions are required to trigger the long runtime?

An attacker must supply a crafted PDF and cause the application to load relevant parts of that file, such as its pages. The PDF repeatedly references the same indirect object even though that object does not exist.

Which pypdf release fixes the issue?

The issue is fixed in pypdf version 6.21.2.

What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4240 as a workaround.

GHSA-6c7f-9265-g8fw: Pip/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the long runtime?

Which pypdf release fixes the issue?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the long runtime?

Which pypdf release fixes the issue?

What can be done if upgrading is not immediately possible?