GHSA-jr96-gvgh-j3r4 - pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.
### Patches
This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).
### Notes
This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.
HIGH
Severity & confidence
Source severityhigh
Platform severityhigh
Confidenceconfirmed
Exploitationunknown
CVSS-
Affected
VendorspypdfRed Hat
Productspypdf
Reporting sources (3)
GitHub Security Advisories
Red Hat - CVE Feed
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-23T20:54:27
Last updated2026-10-27T15:37:20
Ingested2026-10-23T20:56:57
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
This object is reported by 3 independent sources.
Source type: vendor ยท Original: GitHub Security Advisories