N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4xc4-762w-m6cg

GHSA-4xc4-762w-m6cg: pypdf has possible long runtimes for missing /Root object with large /Size values

Impact

An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected.

Patches

This has been fixed in pypdf==6.6.0.

Workarounds

from pypdf import PdfReader, PdfWriter


# Instead of
reader = PdfReader("file.pdf")
# use the strict mode:
reader = PdfReader("file.pdf", strict=True)

# Instead of
writer = PdfWriter(clone_from="file.pdf")
# use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))

Resources

This issue has been fixed in #3594.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4xc4-762w-m6cg

GHSA-4xc4-762w-m6cg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.6.0	6.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified three functions in the pypdf library that are susceptible to Denial of Service (DoS) attacks when processing specially crafted PDF files. The root cause of these vulnerabilities is the library's handling of malformed or malicious PDF structures in its non-strict parsing mode, which is the default.

PdfReader.root_object: The primary vulnerability, as described in the security advisory, lies in this function. When a PDF file is missing the /Root object in its trailer, pypdf attempts to find it by iterating through a number of objects defined by the /Size key in the trailer. An attacker can provide a very large /Size value, causing the application to enter a resource-intensive loop for an extended period, effectively causing a DoS. The patch mitigates this by introducing root_object_recovery_limit to cap the number of objects scanned.
PdfReader._rebuild_xref_table: The security patch also addresses a performance bottleneck in the cross-reference (xref) table rebuilding process. The original implementation used a regular expression that was inefficient for files containing large amounts of whitespace, making it another vector for a DoS attack. The patch replaces this with a faster, non-regex-based search.
PdfDocCommon._flatten: A third DoS vector was found in the page flattening logic. The code did not check for cyclic page references, where a page object could reference its parent, leading to infinite recursion and a stack overflow. The patch adds an explicit check to break such loops.

All three functions are part of the PDF reading and parsing process and would appear in a runtime profile during the exploitation of these vulnerabilities. The analysis of the commit patch directly points to these functions as the locations of the vulnerabilities and the subsequent fixes.

Vulnerable functions

PdfReader.root_object

pypdf/_reader.py

When a PDF is opened in non-strict mode and lacks a `/Root` object in its trailer, the `root_object` property attempts to find the root object by iterating through all object numbers specified by the `/Size` entry in the trailer. A malicious PDF can set a very large `/Size` value, causing the application to enter a long-running loop, leading to a denial of service. The patch introduces a limit to this loop.

PdfReader._rebuild_xref_table

pypdf/_reader.py

When rebuilding a broken cross-reference (xref) table, the `_rebuild_xref_table` function used a regular expression to find PDF objects. This regex could perform very poorly on specially crafted PDF files containing a large amount of whitespace, leading to excessive CPU usage and a denial of service. The patch replaces the slow regex with a more performant string search.

PdfDocCommon._flatten

pypdf/_doc_common.py

The `_flatten` function, which processes the page tree structure of a PDF, did not protect against cyclic references. A malicious PDF could define a page tree where a child page object refers back to its parent. This would cause an infinite recursion loop when `_flatten` is called, leading to a stack overflow and denial of service. The patch adds a check to detect such cyclic references.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-4xc4-762w-m6cg: pypdf has possible long runtimes for missing /Root object with large /Size values

Impact

Patches

Workarounds

Resources

GHSA-4xc4-762w-m6cg:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Technical Details

GHSA-4xc4-762w-m6cg: pypdf has possible long runtimes for missing /Root object with large /Size values

Impact

Patches

Workarounds

Resources

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI