{"id":"RHLW-2026-8c3fe2e9e5dcb600","summary":"Lightwell Security Advisory: pypdf 6.21.1+rhlw.1","details":"Red Hat Lightwell has released pypdf 6.21.1+rhlw.1 with backported fixes for CVE-2026-115585, CVE-2026-115572, and CVE-2026-115580.\n\nCVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)\n\nCVE-2026-115572: pypdf: Possible long runtimes for repeated references to the same missing object\n\nCVE-2026-115580: pypdf: Possible long runtimes for large xref table header limits\n\nThis patched artifact is a drop-in replacement for pypdf 6.21.1 from PyPI.","modified":"2026-11-06T19:43:10.293570063Z","published":"2026-11-06T16:40:15Z","upstream":["CVE-2026-115572","CVE-2026-115580","CVE-2026-115585","GHSA-6c7f-9265-g8fw","GHSA-gmh7-3g9r-mjh5","GHSA-jr96-gvgh-j3r4"],"references":[{"type":"WEB","url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115585.json"},{"type":"ADVISORY","url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115585"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/pull/4240"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jr96-gvgh-j3r4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115572.json"},{"type":"ADVISORY","url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115572"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6c7f-9265-g8fw"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115580.json"},{"type":"ADVISORY","url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115580"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/pull/4239"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gmh7-3g9r-mjh5"}],"affected":[{"package":{"name":"pypdf","ecosystem":"Red Hat Lightwell:PyPI","purl":"pkg:pypi/pypdf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.21.1+rhlw.1"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.16.0","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.3.1","5.0.0","5.0.1","5.1.0","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.6.1","5.7.0","5.8.0","5.9.0","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.10.0","6.10.1","6.10.2","6.11.0","6.12.0","6.12.1","6.12.2","6.13.0","6.13.1","6.13.2","6.13.3","6.14.0","6.14.1","6.14.2","6.15.0","6.16.0","6.16.1","6.16.2","6.17.0","6.18.0","6.18.1","6.19.0","6.2.0","6.20.0","6.20.1","6.21.0","6.21.1","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.6.0","6.6.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","6.7.5","6.8.0","6.9.0","6.9.1","6.9.2"],"database_specific":{"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-8c3fe2e9e5dcb600.json","lightwell":{"backport_base_version":"6.21.1","remediated_version":"6.21.1+rhlw.1","repository_url":"https://packages.redhat.com/lightwell/python/remediated/"}}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}