CVE-2026-113789

What it actually does

Crafted PDF documents trigger excessive memory allocation or prolonged computation during form field enumeration in pypdf versions before 6.21.0, resulting in denial-of-service conditions.

Why it matters to the business

Services and applications that parse untrusted PDFs with this library may experience slowdowns, high resource consumption, or crashes, disrupting document workflows and increasing operational costs; the issue surfaced only five days ago with rising exploit probability.

How an attack unfolds

An attacker generates a malicious PDF containing specially structured form fields, then supplies it to any application that calls pypdf to retrieve those fields, forcing the library into resource-intensive processing that can exhaust memory or CPU.

How to fix it

Upgrade pypdf to version 6.21.0 or later in all environments; verify the installed version before processing untrusted PDFs and test form-field extraction after the update.

How to confirm the fix worked

Confirm the pypdf package version is 6.21.0 or newer via package manager or import metadata; run regression tests that exercise form-field retrieval on both benign and previously problematic PDFs.

Typical attack path

1. Identify target application accepting PDF uploads or attachments
2. Craft PDF with form fields engineered to maximize memory or runtime during enumeration
3. Deliver the PDF to the victim application
4. Observe resulting high memory usage, long processing times, or application crash

How to detect it

Review application and system logs for unusually high memory or CPU usage during PDF form-field operations; correlate spikes with PDF ingestion timestamps and inspect any unpatched pypdf instances.

What your security team should do

• Immediately inventory all deployments using pypdf and schedule upgrade to 6.21.0
• Add version checks and PDF processing timeouts to prevent resource exhaustion until patched
• Monitor EPSS trend and reassess in 30 days if exploit maturity increases