CVE-2026-113790 · GHSA-f54x-cmq8-qg57
pypdf: Possible large memory usage when parsing arrays and dictionaries
- Risk score
- 48/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.
- Affected
- pypdf (pip) < 6.21.0
- Fix
- Upgrade pypdf to 6.21.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
The flaws
- CVE-2026-113790: Possible large memory usage when parsing arrays and dictionaries (CVSS 6.0 · EPSS 0%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
The fix
Upgrade pypdf: 6.21.0 · 6.21.2 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 255 other warnings in 30 days
Why it is Yellow
- CVSS 6.0 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.21.0 | 6.21.0 |
References
- https://github.com/advisories/GHSA-f54x-cmq8-qg57
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57
- https://nvd.nist.gov/vuln/detail/CVE-2026-113790
- https://github.com/py-pdf/pypdf/pull/4218
- https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12
- https://github.com/py-pdf/pypdf/releases/tag/6.21.0
- https://github.com/advisories/GHSA-f54x-cmq8-qg57
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.
Last activity 21 Oct 2026. Patch Forecast updates every hour.