PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22690 py-pdf CVE debrief

CVE-2026-22690 is a vulnerability in the pypdf library that can cause long runtimes for invalid PDF files. The issue arises from a missing /Root object with large /Size values, affecting non-strict reading mode. This vulnerability is patched in version 6.6.0. Defenders should be aware of this issue and take steps to upgrade to the patched version to prevent potential long runtimes in PDF processing workflows. The vulnerability can be exploited by crafting a PDF that leads to long runtimes for actually invalid files, achieved by omitting the /Root entry in the trailer while using a large /Size value.

Vendor
py-pdf
Product
pypdf
CVSS
LOW 2.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-10
Original CVE updated
2026-11-02
Advisory published
2026-01-10
Advisory updated
2026-11-02

Who should care

Defenders responsible for PDF processing workflows, particularly those using the pypdf library, should be aware of this vulnerability and take steps to upgrade to version 6.6.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that PDF processing workflows are secure and efficient. Upgrading to the patched version will help prevent potential long runtimes and performance issues

Why it matters

Defenders should prioritize upgrading to pypdf version 6.6.0 or later to prevent potential long runtimes. This vulnerability affects PDF processing workflows using the pypdf library, particularly in non-strict reading mode.

  • Potential long runtimes for PDF processing
  • Performance issues with PDF processing workflows

Technical summary

The pypdf library has a vulnerability that can cause long runtimes for invalid PDF files due to a missing /Root object with large /Size values, affecting non-strict reading mode. This issue is patched in version 6.6.0. The vulnerability can be exploited by crafting a PDF that leads to long runtimes for actually invalid files. Defenders should prioritize upgrading to pypdf version 6.6.0 or later to prevent potential long runtimes in PDF processing workflows. The attack involves omitting the /Root entry in the trailer and using a large /Size value.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.6.0 or later to prevent potential long runtimes.

Recommended defensive actions

  • Upgrade to pypdf version 6.6.0 or later
  • Review and update PDF processing workflows to handle potential long runtimes
  • Monitor for and address potential performance issues with PDF processing
  • Verify PDF processing workflows using the pypdf library
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a missing /Root object with large /Size values in a PDF file, leading to long runtimes in non-strict reading mode. This issue has been confirmed in pypdf versions prior to 6.6.0. The attack involves crafting a PDF that omits the /Root entry in the trailer and uses a large /Size value, which can cause long runtimes for invalid files. Defenders should verify PDF processing workflows using the pypdf library and ensure they are upgraded to version 6.6.0 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22690 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22690

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22690 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22690

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.