CVE-2026-115585 · GHSA-jr96-gvgh-j3r4
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
- Risk score
- 61/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference…
- Affected
- pypdf (pip) < 6.21.2
- Fix
- Upgrade pypdf to 6.21.2 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference…
The flaws
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
- CVE-2026-113792: Possible infinite loop in PdfWriter.find_outline_item (CVSS 6.0 · EPSS 0%)
The fix
Upgrade pypdf: 6.21.2 · 6.20.1 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 256 other warnings in 30 days
Why it is Amber
- CVSS 7.1 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.21.2 | 6.21.2 |
References
- https://github.com/advisories/GHSA-jr96-gvgh-j3r4
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4
- https://github.com/py-pdf/pypdf/pull/4240
- https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
- https://github.com/py-pdf/pypdf/releases/tag/6.21.2
- https://github.com/advisories/GHSA-jr96-gvgh-j3r4
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.
Last activity 23 Oct 2026. Patch Forecast updates every hour.