2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22691

CVE-2026-22691: pypdf has possible long runtimes for malformed startxref

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22691

CVE-2026-22691:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.6.0	6.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis of CVE-2026-22691 in pypdf reveals three distinct denial-of-service vulnerabilities that were addressed in a single patch. The primary vulnerability, and the one highlighted in the advisory title, is due to an inefficient regular expression in the PdfReader._rebuild_xref_table method. This regex could be exploited by a crafted PDF containing excessive whitespace, leading to catastrophic backtracking and causing the application to hang.

In addition to the ReDoS vulnerability, the patch also fixes two other issues:

An unbounded loop in the PdfReader.root_object method, which could be triggered by a forged /Size attribute in the PDF trailer, leading to excessive CPU usage.
An infinite recursion vulnerability in the PdfDocCommon._flatten method, caused by a lack of checks for cyclic page references in the PDF structure.

All three vulnerabilities can be triggered when parsing a malicious PDF file in the default non-strict mode. The identified functions (PdfReader._rebuild_xref_table, PdfReader.root_object, and PdfDocCommon._flatten) are the direct locations of these vulnerabilities, and their corresponding fixes are clearly visible in the provided commit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.