PyPI/pypdf CVE-2026-22690: medium 5.3, EPSS 0.43%

pypdf has possible long runtimes for missing /Root object with large /Size values

Action: Upgrade pypdf to 6.6.0 or later.

pip install pypdf==6.6.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1829
• nvd: CVE-2026-22690
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg
• https://github.com/py-pdf/pypdf/pull/3594
• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0
• https://pypi.org/project/pypdf
• https://github.com/advisories/GHSA-4xc4-762w-m6cg

CVE-2026-22690 · published 2026-07-07T16:03:17.493066Z · modified 2026-07-07T17:46:58.600168956Z · JSON