{"action":"Upgrade pypdf to 6.12.0 or later.","affected":[{"fixed":"6.12.0","introduced":"0"}],"component":"pypdf","cve_ids":["CVE-2026-48156"],"ecosystem":"PyPI","epss":0.00124,"exploited":false,"fixed_versions":["6.12.0"],"ghsa_id":"GHSA-248m-82v9-q6g6","id":"tcs_01M5KERQJKXJF45R93AY9PNRCX","modified_at":"2026-09-10T03:51:07.304973624Z","published_at":"2026-06-12T18:29:59Z","references":["https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6","https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6","https://nvd.nist.gov/vuln/detail/CVE-2026-48156","https://github.com/py-pdf/pypdf/pull/3791","https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70","https://github.com/py-pdf/pypdf","https://github.com/py-pdf/pypdf/releases/tag/6.12.0"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-248m-82v9-q6g6","url":"https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6"}],"summary":"pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams"}