Açıklama
A crafted PDF whose indirect object identifiers or generation numbers run on without whitespace made pypdf scan excessive input in read_until_whitespace, causing long runtimes and high memory use (CWE-400, CWE-407). An application that opens untrusted PDFs with pypdf could be made unavailable by a single file. Fixed in 6.18.0 (PR #4055).
CVSS Vektörü
Birincil değerlendirmeGitHub CNA · 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NAV: Ağ (Network)AC: Düşük (Low)AT: Yok (None)PR: Yok (None)UI: Yok (None)VC: Yok (None)VI: Yok (None)VA: Yüksek (High)SC: Yok (None)SI: Yok (None)SA: Yok (None)
Bildirim Durumu
- Etkilenen sürümler
- pypdf before 6.18.0
- Yama durumu
- Fixed in 6.18.0
- Üretici yanıtı
- Maintainers limited the length of indirect object tokens (PR #4055) and published GHSA-5jq2-8x83-x246
- Birincil puan kaynağı
- GitHub CNA
Referanslar
- CVE.org Kaydı
- GitHub Security Advisory GHSA-5jq2-8x83-x246
- Fix: limit allowed length of indirect object tokens (PR #4055)
- Fix commit 82501d2
- pypdf 6.18.0 release
- NVD — Ulusal Zafiyet Veritabanı
- MITRE CVE Girişi
Kayıt Doğrulama
KrediGitHub advisory GHSA-5jq2-8x83-x246, bildiren olarak Sevban DÖNMEZ (jankesec) adını belirtir
YayınlanmaCVE kaydı 2026-09-30 tarihinde yayınlandı
KontrolMetaveriler son olarak 2026-10-30 tarihinde CVE Services kaydıyla doğrulandı
Bildirim Zaman Çizelgesi
2026-09-07Fix merged — Maintainers merged the change that limits the length of indirect object tokens (PR #4055). Kaynak ↗
2026-09-30Published — GitHub, as CNA, published the CVE record and advisory GHSA-5jq2-8x83-x246. Kaynak ↗
2026-10-30Site verification — jankesec checked the CVE record, score, affected versions, and references.