Most recent entries from all

BREW-pdfalyzer-CVE-2026-115585 — pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

2026-10-25T23:51:26.782230+00:00

Affected: Homebrew: pdfalyzer

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).

### Notes

This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.

fkie_cve-2026-115585

2026-10-25T23:51:26.782344+00:00

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

GHSA-jr96-gvgh-j3r4 — pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

2026-10-25T23:51:26.782394+00:00

Affected: PyPI: pypdf