CVE-2026-41168

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-834

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41175.3The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing cap CVE-2026-411707.2Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.Pos CVE-2026-411717.3Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request CVE-2026-411727.3Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allo CVE-2026-411735.9The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTe CVE-2026-411746.4Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in CVE-2026-411758.1Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters o CVE-2026-411769.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` CVE-2026-411775.5Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is CVE-2026-411785.3OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to CVE-2026-411799.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and CVE-2026-41184.3The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This