Potential Processing Delays in pypdf Library Versions by PyPDF

CVE-2026-22690

What is CVE-2026-22690?

The pypdf library, an open-source pure Python PDF processor, is vulnerable to significant performance degradation due to malformed PDF files. Specifically, the absence of a /Root object combined with large /Size values can lead to excessive run times when processing these invalid files. This issue primarily affects the library's non-strict reading mode. A fix has been implemented in version 6.6.0, ensuring that users of the library can avoid these processing delays when handling potentially malicious PDF documents.

References