PyPI/pypdf CVE-2026-22691: medium 5.3, EPSS 0.43%

pypdf has possible long runtimes for malformed startxref

Action: Upgrade pypdf to 6.6.0 or later.

pip install pypdf==6.6.0

Affected

Fixed versions

Sources

• osv: GHSA-4f6g-68pf-7vhv
• nvd: CVE-2026-22691
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv
• https://github.com/py-pdf/pypdf/pull/3594
• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0

CVE-2026-22691 · published 2026-01-09T19:48:57Z · modified 2026-07-07T17:56:05.491150444Z · JSON