{"action":"Upgrade pypdf to 6.12.0 or later.","affected":[{"fixed":"6.12.0","introduced":"0"}],"component":"pypdf","cve_ids":["CVE-2026-48156"],"ecosystem":"PyPI","epss":0.00124,"exploited":false,"fixed_versions":["6.12.0"],"ghsa_id":"GHSA-248m-82v9-q6g6","id":"tcs_01M5KH2VWQP5KV0TGD3XJW1BGN","modified_at":"2026-07-13T16:33:08.822851445Z","published_at":"2026-07-13T15:46:16.987203Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3004","https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6","https://nvd.nist.gov/vuln/detail/CVE-2026-48156","https://github.com/py-pdf/pypdf/pull/3791","https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70","https://github.com/py-pdf/pypdf","https://github.com/py-pdf/pypdf/releases/tag/6.12.0","https://pypi.org/project/pypdf","https://github.com/advisories/GHSA-248m-82v9-q6g6"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-3004","url":"https://osv.dev/vulnerability/PYSEC-2026-3004"}],"summary":"pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams"}