CVE-2026-115572 · GHSA-6c7f-9265-g8fw
pypdf: Possible long runtimes for repeated references to the same missing object
- Risk score
- 61/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
- Affected
- pypdf (pip) < 6.21.2
- Fix
- Upgrade pypdf to 6.21.2 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
The flaws
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
- CVE-2026-113792: Possible infinite loop in PdfWriter.find_outline_item (CVSS 6.0 · EPSS 0%)
The fix
Upgrade pypdf: 6.21.2 · 6.20.1 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 252 other warnings in 30 days
Why it is Amber
- CVSS 7.1 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.21.2 | 6.21.2 |
References
- https://github.com/advisories/GHSA-6c7f-9265-g8fw
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw
- https://github.com/py-pdf/pypdf/pull/4240
- https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
- https://github.com/py-pdf/pypdf/releases/tag/6.21.2
- https://github.com/advisories/GHSA-6c7f-9265-g8fw
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.
Last activity 23 Oct 2026. Patch Forecast updates every hour.