Long Runtime Vulnerability in pypdf: Missing /Root Object with Large /Size Values
Summary
GHSA-4xc4-762w-m6cg: pypdf has possible long runtimes for missing /Root object with large /Size values. Affects pypdf versions < 6.6.0. Fixed in 6.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library used for manipulating PDF files. It allows users to read, write, and modify PDF documents with ease. The library is designed to handle various PDF operations, making it a popular choice among developers. However, it has been found to have a vulnerability that can lead to long runtimes when processing certain malformed PDF files, specifically when the /Root entry is omitted in the trailer while using a large /Size value.
Vulnerability Detail
This vulnerability arises from the handling of PDF files in non-strict reading mode. An attacker can exploit this by crafting a PDF that lacks the /Root entry in the trailer, combined with a large /Size value. This can lead to excessive processing time when the library attempts to read the file, potentially causing denial of service. The issue is particularly concerning in environments where performance and responsiveness are critical.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.6.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can mitigate the risk by using strict mode when reading PDF files. Here is an example of how to implement this in your code:
from pypdf import PdfReader, PdfWriter
Instead of
reader = PdfReader("file.pdf")
use the strict mode:
reader = PdfReader("file.pdf", strict=True)
Instead of
writer = PdfWriter(clone_from="file.pdf")
use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
Conclusion
The pypdf library has a vulnerability that can lead to long runtimes when processing malformed PDF files due to a missing /Root object. It is crucial to update to version 6.6.0 or later to mitigate this risk. Alternatively, using strict mode can serve as a temporary workaround until the update can be applied.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability can lead to long runtimes when processing certain malformed PDF files, potentially causing performance issues or denial of service.
This vulnerability affects all versions of pypdf prior to 6.6.0. Updating to this version or later will resolve the issue.
Always use strict mode when reading PDF files and ensure that you are using the latest version of libraries to mitigate known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
