CVE-2026-113790

What it actually does

The vulnerability allows crafted PDF files containing arrays or dictionaries with an extremely high element count to trigger unbounded memory allocation during parsing in pypdf versions prior to 6.21.0.

Why it matters to the business

Applications that ingest untrusted PDFs may experience sudden memory exhaustion, resulting in service crashes or degraded performance until the process is restarted; the issue is recent with a modest but rising exploitation probability.

How an attack unfolds

An attacker generates a minimal PDF containing one or more arrays or dicts populated with millions of elements, then supplies the file to any application that uses a vulnerable pypdf version to open or read the document; parsing immediately allocates large amounts of RAM and may cause the process or host to become unresponsive.

How to fix it

Upgrade pypdf to version 6.21.0 or later in all environments that process PDF files.

How to confirm the fix worked

Confirm the installed pypdf version is at least 6.21.0; optionally replay a minimal high-element-count PDF against a test instance and verify memory usage remains bounded.

Typical attack path

1. Create a PDF with one or more arrays or dictionaries containing millions of elements
2. Deliver the file to a target application that parses PDFs with pypdf
3. Trigger parsing of the malicious PDF
4. Observe memory consumption leading to denial of service

How to detect it

Monitor for sudden spikes in memory usage or out-of-memory events in processes that call pypdf PDF parsing functions; inspect application logs for unusually long parse times on incoming PDF files.

What your security team should do

• Immediately upgrade all pypdf installations to 6.21.0 or newer
• Add PDF parsing processes to resource-limit monitoring and alerting
• Review any custom PDF ingestion pipelines for untrusted input handling