Is there a patch available for CVE-2026-41168?

Yes, a patch is available for CVE-2026-41168. Update the affected software to the latest version immediately.

pypdf CVE-2026-41168

Q: What is the CVSS score of CVE-2026-41168?

CVE-2026-41168 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25100 MEDIUM

Excessive Iteration (CWE-834)

2026-04-22 GitHub_M

Information Disclosure Python Red Hat Suse

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 24, 2026 - 13:07 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:06 vuln.today

Patch available

Apr 22, 2026 - 22:02 EUVD

CVSS changed

Apr 22, 2026 - 21:22 NVD

6.9 (MEDIUM)

EUVD ID Assigned

Apr 22, 2026 - 21:01 euvd

EUVD-2026-25100

Analysis Generated

Apr 22, 2026 - 21:01 vuln.today

CVE Published

Apr 22, 2026 - 20:49 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on pypdf (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.10.1.

DescriptionGitHub Advisory

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.

AnalysisAI

Denial of service in pypdf prior to version 6.10.1 allows remote attackers to craft malicious PDF files with oversized cross-reference stream /Size values or object stream /N values, causing excessive processing time and long runtimes. No authentication is required; the vulnerability is triggered by parsing a specially crafted PDF file. Patch version 6.10.1 is available from the vendor.

Technical ContextAI

pypdf is a pure-Python PDF parsing library that processes PDF structure including cross-reference streams and object streams. Cross-reference streams contain metadata about indirect objects referenced via /Size parameters, while object streams group multiple objects with /N (count) parameters. The vulnerability stems from CWE-834 (Excessive Iteration), where incorrect large values in these fields cause pypdf to allocate excessive memory or iterate through non-existent object ranges, consuming CPU and memory resources disproportionately to the actual PDF content. The CVSS 4.0 vector shows network accessibility (AV:N), low complexity (AC:L), no authentication (PR:N), and availability impact (VA:L), indicating a resource exhaustion denial-of-service condition rather than data disclosure or code execution.

RemediationAI

Upgrade pypdf to version 6.10.1 or later immediately, as a vendor-released patch is available. For users who cannot immediately upgrade, the patch may be applied manually by applying the changes from GitHub commit 62338e9d36419cf193ccec7331784f45df1d70b3 (https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3) or PR #3733 (https://github.com/py-pdf/pypdf/pull/3733) to the local pypdf installation. As a compensating control while a patch is unavailable, implement strict file size limits and processing timeouts (e.g., 30-second maximum parse time) on PDF processing pipelines to interrupt runaway parsing operations, though this may reject legitimate large PDFs. Additionally, restrict PDF upload functionality to trusted sources and disable automatic PDF processing for external inputs if feasible.