CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5
pypdf: Possible long runtimes for large xref table header limits
- Risk score
- 61/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Affected
- pypdf (pip) < 6.21.2
- Fix
- Upgrade pypdf to 6.21.2 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
The flaws
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-113792: Possible infinite loop in PdfWriter.find_outline_item (CVSS 6.0 · EPSS 0%)
The fix
Upgrade pypdf: 6.21.2 · 6.20.1 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-834 (CWE-834). 6 other warnings in 30 days
Why it is Amber
- CVSS 7.1 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.21.2 | 6.21.2 |
References
- https://github.com/advisories/GHSA-gmh7-3g9r-mjh5
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
- https://github.com/py-pdf/pypdf/pull/4239
- https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2
- https://github.com/py-pdf/pypdf/releases/tag/6.21.2
- https://github.com/advisories/GHSA-gmh7-3g9r-mjh5
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
Last activity 23 Oct 2026. Patch Forecast updates every hour.