Possible Performance Issues in PDF Library Due to Malformed Entries

CVE-2026-22691

What is CVE-2026-22691?

The pypdf library, a Python-based PDF processing tool, allows potential performance degradation due to long runtimes when handling malformed startxref entries. Attackers can exploit this flaw by crafting PDFs that lead to inefficient rebuilding of the cross-reference table, especially in non-strict reading mode. The issue primarily arises when dealing with PDFs containing excessive whitespace characters. This vulnerability has been addressed in version 6.6.0, improving the library's resilience against such crafted files.

References