Repository navigation
Bump pypdf from 6.11.0 to 6.21.2 - #595
Open
superbot-helper wants to merge 1 commit into
Open
superbot-helper wants to merge 1 commit into
superbot-helper wants to merge 1 commit into
Conversation
GHSA-6c7f-9265-g8fw (CVE-2026-115572): pypdf returns early from its object cache only when the lookup is not None, and a missing object is cached as None, so each reference to the same absent object re-copies and re-scans the whole stream. A 1.2 MB PDF whose page tree references one never-defined object 20,000 times takes about 70 s in the page-tree walk on 6.11.0 and 0.025 s on 6.21.2. The API image installs exactly this lock with `uv sync --no-dev --no-install-project --locked`, and _check_pdf runs that walk on every PDF upload to POST /general/v0/general before the route has any chance to time out or reject the file. uv.lock only; no source changes.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates pypdf from 6.11.0 to 6.21.2.
Fixes GHSA-6c7f-9265-g8fw and CVE-2026-115572 — a small PDF holds an API worker for over a minute: a 1,180,298-byte upload to the unauthenticated /general/v0/general route costs 69.9 s in the page-tree walk while the same bytes cost 0.025 s on the fixed release, and the route sets no request timeout and no upload size cap, so a few concurrent uploads deny service.
What this changes:
uv.lock—pypdfmoves from 6.11.0 to 6.21.2, with the sdist and wheel entries that release publishes; no other package or line changesHow to verify:
Why the API route is exposed
POST /general/v0/general(prepline_general/api/general.py:646-647) ->general_partition->_check_pdf(file)atgeneral.py:308->PdfReader(file)atgeneral.py:494->list(pdf.pages)atgeneral.py:503; the route needs no credentials and sets no request timeout.Dockerfile:63-64copiesuv.lockand runsuv sync --no-dev --no-install-project --locked, so the API image runs exactly the pypdf version the lock pins, which is 6.11.0.In 6.11.0 a missing object is cached as
Nonebut the cache lookup returns early only for a non-Nonehit (pypdf/_reader.py:447-451), so each of the 20,000 references re-copies and re-scans the whole stream (:558-570). 6.21.2 adds the resolved-objects membership test (_reader.py:552-557, PR #4240) and stops after the first miss.Measured on one 1.2 MB PDF, same bytes both sides
PdfReader(...).pages, median of 3POST /general/v0/generalon loopback[])[])97d67e8d9d6eb9786cf6f7fcb08dcb05fc3cc31ace61c65780f812ef3236e132; its/Kidsarray names object 9999 20,000 times and object 9999 is never defined, so every reference is a cache miss.The patched lock was re-checked and installed with the repository's own uv 0.13.4 and its own build step before submission, and both pinned releases were re-run on the payload on this host.
Automated security patch from Superbot.