CVE-2026-41168: pypdf has long runtimes for wrong size values in cross-reference and object streams

Executive brief

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values.

### Patches

This has been fixed in [pypdf==6.10.1](https://github.com/py-pdf/pypdf/releases/tag/6.10.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3733](https://github.com/py-pdf/pypdf/pull/3733).

Affected products

• PyPI pypdf

References

• https://api.github.com/users/alpakalee
• https://github.com/alpakalee
• https://api.github.com/users/alpakalee/gists%7B/gist_id%7D
• https://api.github.com/users/alpakalee/repos
• https://avatars.githubusercontent.com/u/105830543?v=4
• https://api.github.com/users/alpakalee/events%7B/privacy%7D