RHLW-2026-8c3fe2e9e5dcb600: Lightwell Security Advisory: pypdf 6.21.1+rhlw.1
Red Hat Lightwell has released pypdf 6.21.1+rhlw.1 with backported fixes for CVE-2026-115585, CVE-2026-115572, and CVE-2026-115580.
CVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-115572: pypdf: Possible long runtimes for repeated references to the same missing object
CVE-2026-115580: pypdf: Possible long runtimes for large xref table header limits
This patched artifact is a drop-in replacement for pypdf 6.21.1 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/pypdfto a version that resolves this vulnerability.Fixed in 6.21.1+rhlw.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.1+rhlw.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which pypdf issues are addressed by this release?
The release backports fixes for CVE-2026-115585, CVE-2026-115572, and CVE-2026-115580. These issues involve possible long runtimes when processing malformed cross-reference entries, repeated references to a missing object, or large cross-reference table header limits.
Can this artifact replace the standard PyPI package without application changes?
Yes. The advisory states that pypdf 6.21.1+rhlw.1 is a drop-in replacement for pypdf 6.21.1 from PyPI.