CVE-2026-22691
📋 TL;DR
This vulnerability in pypdf allows attackers to craft malicious PDF files that cause excessive processing time when parsing malformed startxref entries. It affects systems using pypdf in non-strict reading mode to process untrusted PDF files. The attack leads to resource exhaustion through denial of service.
💻 Affected Systems
- pypdf
📦 What is this software?
Pypdf by Pypdf Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service where processing a malicious PDF consumes excessive CPU resources for extended periods, potentially causing application timeouts or system resource exhaustion.
Likely Case
Degraded performance or temporary unavailability of services processing PDF files, requiring manual intervention to terminate hung processes.
If Mitigated
Minimal impact with proper input validation, strict mode usage, and resource limits in place.
🎯 Exploit Status
Exploitation requires crafting a PDF with malformed startxref and excessive whitespace. No authentication needed if application accepts PDF uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.0
Vendor Advisory: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv
Restart Required: No
Instructions:
1. Update pypdf: pip install --upgrade pypdf==6.6.0
2. Verify installation: pip show pypdf
3. Test with known vulnerable PDF samples to confirm fix
🔧 Temporary Workarounds
Use strict reading mode
allConfigure pypdf to use strict mode when processing untrusted PDFs
pdf_reader = PdfReader(file_path, strict=True)
Implement timeout controls
linuxAdd timeout mechanisms around PDF processing operations
import signal
class TimeoutException(Exception): pass
def timeout_handler(signum, frame): raise TimeoutException()
signal.signal(signal.SIGALRM, timeout_handler)
signal.alarm(30) # 30 second timeout
🧯 If You Can't Patch
- Implement strict mode for all PDF processing of untrusted files
- Add resource limits and monitoring for PDF processing operations
🔍 How to Verify
Check if Vulnerable:
Check pypdf version: pip show pypdf | grep VersionCheck Version:
python -c "import pypdf; print(pypdf.__version__)"Verify Fix Applied:
Test with the proof-of-concept PDF from the advisory or verify version is 6.6.0+📡 Detection & Monitoring
Log Indicators:
- Long-running PDF processing tasks
- Process timeouts when handling PDF files
- High CPU usage from PDF parsing processes
Network Indicators:
- Multiple large PDF uploads to vulnerable endpoints
- PDF files with unusual size-to-content ratios
SIEM Query:
process_name:pypdf AND (duration>30s OR cpu_usage>90%)