Most recent entries from all

bdu:2026-07226

BREW-pdfalyzer-CVE-2026-22691 — pypdf has possible long runtimes for malformed startxref

Affected: Homebrew: pdfalyzer

### Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python from pypdf import PdfReader, PdfWriter

# Instead of reader = PdfReader("file.pdf") # use the strict mode: reader = PdfReader("file.pdf", strict=True)

# Instead of writer = PdfWriter(clone_from="file.pdf") # use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ```

### Resources This issue has been fixed in #3594.

certfr-2026-avi-0224 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0224

EUVD-2026-265411

fkie_cve-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

GHSA-4f6g-68pf-7vhv — pypdf has possible long runtimes for malformed startxref

Affected: PyPI: pypdf

### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python from pypdf import PdfReader, PdfWriter

# Instead of reader = PdfReader("file.pdf") # use the strict mode: reader = PdfReader("file.pdf", strict=True)

# Instead of writer = PdfWriter(clone_from="file.pdf") # use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ```

### Resources This issue has been fixed in #3594.

PYSEC-2026-1828 — pypdf has possible long runtimes for malformed startxref

Affected: PyPI: pypdf

### Patches This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python from pypdf import PdfReader, PdfWriter

# Instead of reader = PdfReader("file.pdf") # use the strict mode: reader = PdfReader("file.pdf", strict=True)

# Instead of writer = PdfWriter(clone_from="file.pdf") # use an explicit strict reader: writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True)) ```

### Resources This issue has been fixed in #3594.

UBUNTU-CVE-2026-22691

Affected: Ubuntu:Pro:16.04:LTS: pypdf2, Ubuntu:Pro:18.04:LTS: pypdf2, Ubuntu:20.04:LTS: pypdf2, Ubuntu:22.04:LTS: pypdf2, Ubuntu:24.04:LTS: pypdf, Ubuntu:24.04:LTS: pypdf2, Ubuntu:25.10: pypdf, Ubuntu:26.04:LTS: pypdf

WID-SEC-W-2026-1730 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.