GHSA-gmh7-3g9r-mjh5 - pypdf: Possible long runtimes for large xref table header limits
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
### Patches
This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).
HIGH
Severity & confidence
Source severityhigh
Platform severityhigh
Confidenceconfirmed
Exploitationunknown
CVSS-
Affected
VendorspypdfRed Hat
Productspypdf
Reporting sources (3)
GitHub Security Advisories
Red Hat - CVE Feed
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-23T20:54:12
Last updated2026-10-27T15:37:20
Ingested2026-10-23T20:56:57
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
This object is reported by 3 independent sources.
Source type: vendor ยท Original: GitHub Security Advisories
