CVE-2026-22691
pypdf has possible long runtimes for malformed startxref
Reported by github_m · Published January 10, 2026
pypdf is fixed in 6.6.0 (PyPI)
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| pypdf | PyPI | 6.6.0 |
| pypdf | pypdf_project | 6.6.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| py-pdf | pypdf | < 6.6.0 |
| py-pdf | pypdf | 0 |
Timeline
- Jan 9, 2026 CVE Published
- Jan 9, 2026 Fix PR Merged
- Jan 10, 2026 EPSS Score (30 in total, the first dated here)
- Jan 12, 2026 CVE Updated
- Jan 21, 2026 PoC Published (7 in total, the first dated here)
- Jan 30, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-22691
vulnetix vdb fixes CVE-2026-22691Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-22691/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/pull/3594 x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45 x_refsource_MISC
- https://github.com/py-pdf/pypdf/releases/tag/6.6.0 x_refsource_MISC