CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

• CWE-400
• CWE-1333

• https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45Patch
• https://github.com/py-pdf/pypdf/pull/3594Issue Tracking, Patch
• https://github.com/py-pdf/pypdf/releases/tag/6.6.0Release Notes
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhvMitigation, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22686Enclave is a secure JavaScript sandbox designed for safe AI …10
• CVE-2026-22687WeKnora is an LLM-powered framework designed for deep docume…9.8
• CVE-2026-22688WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-22689Mailpit is an email testing tool and API for developers. Pri…6.5
• CVE-2026-2269The Uncanny Automator – Easy Automation, Integration, Webhoo…7.2
• CVE-2026-22690pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-22692October is a Content Management System (CMS) and web platfor…6.8
• CVE-2026-22693HarfBuzz is a text shaping engine. Prior to version 12.3.0, …5.3
• CVE-2026-22694AliasVault is a privacy-first password manager with built-in…6.1
• CVE-2026-22695LIBPNG is a reference library for use in applications that r…7.1
• CVE-2026-22696dcap-qvl implements the quote verification logic for DCAP (D…9.3
• CVE-2026-22697CryptoLib provides a software-only solution using the CCSDS …7.5