CVE-2026-115572

What it actually does

The flaw causes pypdf to repeatedly perform full-file recovery loads when processing a PDF containing repeated references to the same nonexistent indirect object, resulting in excessive runtime and resource consumption during page or object access.

Why it matters to the business

Applications and services that parse or render PDF documents may experience prolonged processing delays or unresponsiveness, disrupting document workflows, user productivity, and automated pipelines that rely on PDF handling.

How an attack unfolds

An attacker crafts a PDF file that repeatedly references the same nonexistent indirect object. When a vulnerable application uses pypdf to access pages or other relevant structures within the file, the library triggers repeated full-file recovery operations, leading to long runtimes and potential denial of service.

How to fix it

Upgrade pypdf to version 6.21.2 or later in all affected environments and rebuild or redeploy dependent applications.

How to confirm the fix worked

Confirm the installed pypdf version is 6.21.2 or higher via package metadata or import checks. Test processing of known trigger PDFs to verify absence of excessive runtime or repeated recovery behavior.

Typical attack path

1. Craft a malicious PDF containing repeated references to nonexistent indirect objects
2. Deliver the crafted PDF to a target application or service using vulnerable pypdf
3. Trigger parsing or access of pages or objects within the PDF
4. Observe repeated full-file recovery loads resulting in excessive runtime

How to detect it

Review application and library logs for unusually long PDF processing durations or repeated recovery operations on PDF files. Correlate spikes in CPU or memory usage with PDF parsing events.

What your security team should do

• Upgrade pypdf to 6.21.2 or later within the next maintenance window
• Inventory all applications and services using pypdf and prioritize updates based on exposure to untrusted PDFs
• Implement input validation or sandboxing for PDF processing where upgrades are delayed