Cloudanix VulnDB

CVE-2026-115580

None

CVSS

—

EPSS

0.4%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A specially made PDF file can make programs that read PDFs using this library slow down or stop responding until the program is restarted.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

pypdf parser allocates and processes cross-reference table entries based on the declared count in the PDF trailer without validating against actual file content or size limits, resulting in excessive CPU and memory consumption during table reconstruction.

Why it matters to the business

Opening a single malicious PDF can cause applications or services that use pypdf to become unresponsive for extended periods, interrupting document workflows, automated processing pipelines, and any dependent business operations.

How an attack unfolds

An attacker generates a PDF whose standard cross-reference table declares far more entries than the file physically contains, then delivers the file to a target that uses an affected pypdf version; when the library parses the trailer and attempts to materialize the oversized table, the process stalls.

How to fix it

Upgrade pypdf to version 6.21.2 or later in all environments; rebuild and redeploy any containers, virtual environments, or packages that depend on the library.

How to confirm the fix worked

Confirm installed version is 6.21.2 or newer via package metadata; test parsing of a synthetic PDF containing an oversized cross-reference table and verify processing completes within expected time bounds.

Typical attack path

  1. Craft PDF with inflated cross-reference table entry count
  2. Deliver file via email, web upload, or shared storage
  3. Victim application opens the PDF using pypdf < 6.21.2
  4. Parser enters long-running reconstruction loop
  5. Application or service becomes unavailable until timeout or manual termination

How to detect it

Review application logs for unusually long PDF parsing durations or timeouts on PDF ingestion endpoints; correlate with file upload or email attachment events in the days following publication.

What your security team should do

  • Immediately inventory all systems and codebases using pypdf and schedule upgrade to 6.21.2
  • Prioritize upgrade in any internet-facing or high-throughput document processing services
  • Add pypdf version checks to dependency scanning and CI pipelines
  • Monitor CPU and memory usage during PDF ingestion for the next 30 days

The record

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities