2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22690

CVE-2026-22690: pypdf has possible long runtimes for missing /Root object with large /Size values

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22690

CVE-2026-22690:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.6.0	6.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-22690 describes a denial-of-service (DoS) condition in pypdf caused by long runtimes when processing a malicious PDF. The root cause is the lack of proper limits when handling partially broken or non-compliant PDF files in the non-strict parsing mode.

Based on the analysis of the patch 294165726b646bb7799be1cc787f593f2fdbcf45, three key functions were identified as being vulnerable to DoS attacks:

PdfReader.root_object: This is the primary function related to the CVE description. If a PDF is missing the /Root object in its trailer, this function attempts to find it by iterating through a number of objects specified by the /Size key. A malicious actor can set an extremely large /Size value, causing this function to loop for an extended period, consuming significant CPU resources. The patch mitigates this by introducing root_object_recovery_limit.
PdfReader._rebuild_xref_table: This function is called when the PDF's cross-reference table is broken. The original implementation used a regular expression to scan the file for object definitions. This regex was inefficient on files containing large amounts of whitespace, leading to very long processing times. The patch replaces this with a faster, non-regex-based scanning method (_find_pdf_objects).
_flatten: This function is responsible for creating a flat list of all pages in the document. A malicious PDF could contain a cyclic page reference (e.g., a page being its own child). The original code did not detect this, leading to infinite recursion and a stack overflow. The patch adds a check to detect and raise an error for such cyclic references.

All three functions are susceptible to causing a denial of service by consuming excessive system resources (CPU or memory) when parsing a crafted PDF file. During exploitation, these functions would likely appear in a runtime profile or stack trace as they enter long-running loops or deep recursion.

Vulnerable functions

PdfReader.root_object

pypdf/_reader.py

In non-strict mode, if the PDF trailer is missing the '/Root' object entry, the 'root_object' method attempts to find it by iterating through objects. The number of objects to check is determined by the '/Size' value from the trailer. An attacker can craft a PDF with a very large '/Size' value, causing this loop to execute for a prolonged period, leading to a denial of service through excessive CPU consumption. The patch introduces a 'root_object_recovery_limit' to cap the number of iterations.

PdfReader._rebuild_xref_table

pypdf/_reader.py

When a broken 'startxref' table is found, this method attempts to rebuild it by scanning the file for PDF objects. The original implementation used a regular expression which performed poorly on files with a large amount of whitespace, leading to excessive processing time and a potential denial of service. The patch replaces the regex with a more performant manual search.

_flatten

pypdf/_doc_common.py

When flattening the pages of a PDF, a specially crafted file could have a cyclic reference where a '/Kids' entry in a '/Pages' object points back to the '/Pages' object itself. This would cause an infinite recursion, leading to a stack overflow and denial of service. The patch adds an explicit check to detect and prevent such cyclic references.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.