VDB

RHSA-2026:83822

RHSA-2026:83822 PUBLISHED CVSS 7.5 HIGH

Record from redhat · Published October 16, 2026

A flaw was found in pypdf. By supplying a specially crafted PDF document containing excessively long indirect object identifiers or generation tokens without whitespace, a remote attacker can trigger unbounded input scanning during parsing. This issue causes significant processing delays and excessive resource consumption, leading to a Denial of Service (DoS) and application unavailability.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Red Hatregistry.redhat.io/quay/clair-rhel9@sha256:9c51fdcb67700ef2ec1f2ce405420a92e9776657fa4ca0e86898e97ac946822c_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:0376a7856c87f47f7f1102359f8235ebad33089c1fb3a831c97d818ad6aefffa_arm64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:76bdb31251000e123e4bff75427ef38a5a11ee1ca8dba40301240aaf9149f311_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:abd978d450485fa53641d4d38c869c5169fbb522b4de1004f92b1bcba1147460_arm64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-rhel9@sha256:cc11410ef6d8eab0def018e1cadbddbff8c50f4cb17af8dbf94a31cef7f21981_arm64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-rhel9@sha256:b06f7aba798a7ea01fbb04705815280ab7d5d1b7a637263049f0f8dfe90530ad_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-rhel9-operator@sha256:dd1b0855abaec32b87e64a11e89ed282b075069021cceb139d523349b7c3e909_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-rhel9@sha256:b46e49899b93a545a51f89574bbbb3f15c73389a978626e223b8e536a9ca7f46_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:683a5d90caf8c762a0a2a2523978d5e6dda63418ca00da66a83b9a341cb88552_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-rhel9-operator@sha256:2d84960bec995da6c3543061d1f5e30af19c9acc4fb4abe743130ced6f0bd6ac_arm64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4259c22e02acb8e9b0d29a48576b79c4999bef094057a0a63383a5a84ac12404_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-rhel9@sha256:ad7a70963fc5ca4bbe970db485c28bca6d53f37d09792b1b8e64f74eaa33b623_s390x as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-rhel9-operator@sha256:78a809afe98430e853a8dfee4739f8ca4937c43d178f561e48654ccfdf01ae97_s390x as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:5f60f635248794bc0fbb3601d25e1b862caca6a18ec7a06fded17002a1588e03_ppc64le as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/clair-rhel9@sha256:703316ec0e97837a05c025d422101ae83b2262d6a36c9d4045aadc02662df523_ppc64le as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-rhel9@sha256:d0eb356ef5469973e81a00f048e19a77ea4b99d70b0079e027b1f11abbf2d24e_s390x as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c0c160954b32398e6ade7a5c9aa53cbb27777e63f579b78b7088ff27de32b712_s390x as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-container-security-operator-bundle@sha256:ace99e59bbb066afa1c18eddabe30e836b5903728956dbaa4cd18b4988f38dc3_amd64 as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:9e50d6cbe79f64844deead5ac1f12d1017535d7f4bbad8ecb13279ba12519d4f_s390x as a component of Red Hat Quay 3.17*
Red Hatregistry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:815790259155f18cb0e97cda94c9ba57b569449e390ee8edf16b31d4a29638e1_ppc64le as a component of Red Hat Quay 3.17*

…and 11 more

Timeline

  • Oct 16, 2026 CVE Published
  • Oct 17, 2026 CVE Updated
  • Oct 17, 2026 Distribution Patch (2 in total, the first dated here)
  • Oct 17, 2026 Security Advisory (3 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026:83822
vulnetix vdb fixes RHSA-2026:83822

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A83822/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›