pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams (CVE-2026-48156) | HOL Guard CVE