CVE-2026-113789 · GHSA-6vvc-x485-93v7
pypdf: Possible long runtimes/large memory usage when retrieving form fields
- Risk score
- 46/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.
- Affected
- pypdf (pip) < 6.21.0
- Fix
- Upgrade pypdf to 6.21.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
The flaws
- CVE-2026-113789: Possible long runtimes/large memory usage when retrieving form fields (CVSS 6.0 · EPSS 0%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
The fix
Upgrade pypdf: 6.21.0 · 6.21.2 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 255 other warnings in 30 days
Why it is Yellow
- CVSS 6.0 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.21.0 | 6.21.0 |
References
- https://github.com/advisories/GHSA-6vvc-x485-93v7
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7
- https://nvd.nist.gov/vuln/detail/CVE-2026-113789
- https://github.com/py-pdf/pypdf/pull/4219
- https://github.com/py-pdf/pypdf/commit/5ef728f0e16d225c853e89f861ba0a67402fe3f2
- https://github.com/py-pdf/pypdf/releases/tag/6.21.0
- https://github.com/advisories/GHSA-6vvc-x485-93v7
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.
Last activity 21 Oct 2026. Patch Forecast updates every hour.