Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-22690

Опубликовано: 10 янв. 2026
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that omits the /Root entry in the trailer and uses a large /Size value. This can lead to excessively long processing times when the PDF is read in non-strict mode, resulting in a Denial of Service (DoS) for the affected system.

Отчет

This vulnerability is rated Moderate. The pypdf library, when processing a specially crafted PDF file that omits the /Root entry and uses a large /Size value in non-strict mode, can lead to excessively long processing times, resulting in a Denial of Service. This affects various components within Red Hat Ansible Automation Platform, OpenShift Lightspeed, Red Hat Enterprise Linux AI, Red Hat OpenShift AI, and Ansible Services.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Lightspeedopenshift-lightspeed/lightspeed-ocp-rag-rhel9Fix deferred
OpenShift Lightspeedopenshift-lightspeed/lightspeed-service-api-rhel9Fix deferred
OpenShift Lightspeedopenshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/de-minimal-rhel8Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/de-minimal-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/de-supported-rhel8Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/de-supported-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/ee-minimal-rhel8Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/ee-minimal-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/ee-supported-rhel8Fix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-400
https://bugzilla.redhat.com/show_bug.cgi?id=2428428pypdf: pypdf: Denial of Service via crafted PDF with missing /Root object

EPSS

Процентиль: 5%
0.00019
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.3
ubuntu
3 месяца назад

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

CVSS3: 5.3
nvd
3 месяца назад

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

CVSS3: 5.3
debian
3 месяца назад

pypdf is a free and open-source pure-python PDF library. Prior to vers ...

github
3 месяца назад

pypdf has possible long runtimes for missing /Root object with large /Size values

EPSS

Процентиль: 5%
0.00019
Низкий

6.5 Medium

CVSS3