pypdf, a pure‑Python PDF library, contains a flaw that allows an attacker to craft a PDF with a malformed startxref section. When the library processes such a file in non‑strict mode, it may spend an excessive amount of time rebuilding the cross‑reference table, especially if many whitespace characters are present. This unusually long runtime can consume CPU resources and potentially deny service to legitimate users.

Any system that uses the pypdf package prior to version 6.6.0 is affected. The vulnerability is present in all releases of the library bundled with the py‑pdf vendor and applies only to the non‑strict reading mode. Applications that import pypdf to parse user‑supplied PDFs are at risk unless they explicitly enforce strict mode or otherwise protect the parsing operation.

The CVSS score is 2.7, indicating a moderate impact. At the time of assessment the exploitation probability is very low (<1 %) and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply the crafted PDF to the target system; if accepted, the long reconstruction phase could lead to denial of service. The issue has already been fixed in version 6.6.0, so upgrading provides a definitive mitigation.