Bug 2428428 (CVE-2026-22690)

Summary:	CVE-2026-22690 pypdf: pypdf: Denial of Service via crafted PDF with missing /Root object
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, bbrownin, bparees, carogers, erezende, haoli, hasun, hkataria, jajackso, jcammara, jfula, jkoehler, jmitchel, jneedle, jowilson, jwong, kegrant, koliveir, kshier, lphiri, mabashia, nyancey, omaciel, ometelka, pbohmill, pbraun, ptisnovs, shvarugh, simaishi, smcdonal, stcannon, syedriko, teagle, tfister, thavo, ttakamiy, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that omits the /Root entry in the trailer and uses a large /Size value. This can lead to excessively long processing times when the PDF is read in non-strict mode, resulting in a Denial of Service (DoS) for the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-10 05:01:38 UTC

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.