CVE-2026-113795 · GHSA-7mh2-4gg2-979f
pypdf: Possible large memory usage for streams with multiple filters
- Risk score
- 49/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.
- Affected
- pypdf (pip) < 6.20.0
- Fix
- Upgrade pypdf to 6.20.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
The flaws
- CVE-2026-113795: Possible large memory usage for streams with multiple filters (CVSS 6.0 · EPSS 0%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
The fix
Upgrade pypdf: 6.20.0 · 6.21.2 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 251 other warnings in 30 days
Why it is Yellow
- CVSS 6.0 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.20.0 | 6.20.0 |
References
- https://github.com/advisories/GHSA-7mh2-4gg2-979f
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f
- https://github.com/py-pdf/pypdf/pull/4173
- https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185
- https://github.com/py-pdf/pypdf/releases/tag/6.20.0
- https://github.com/advisories/GHSA-7mh2-4gg2-979f
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.
Last activity 21 Oct 2026. Patch Forecast updates every hour.