GHSA-gmh7-3g9r-mjh5: Pip/pypdf vulnerability
Published Oct 23, 2026
·Updated
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
Patches
This has been fixed in pypdf==6.21.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4239.
Affected Software
1 affected componentFixes available
pip/pypdf<6.21.2
6.21.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.2 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.2
Event History
Oct 23, 2026
Advisory Published
via GitHub·08:54 PM
Data Sourced
via GitHub·08:54 PM
DescriptionWeaknessAffected Software