Cloudanix VulnDB

CVE-2026-115585

None

CVSS

—

EPSS

0.4%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a popular PDF handling tool can let a specially made document make the program run for a very long time, potentially freezing services that read PDFs.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incomplete handling of repeated malformed cross-reference entries in PDF streams forces repeated full document reloads during recovery attempts even when a cache exists, resulting in excessive CPU consumption and long processing times.

Why it matters to the business

Applications or services that parse untrusted PDFs can become unresponsive or consume excessive resources, disrupting document processing workflows and potentially causing outages for users or dependent systems.

How an attack unfolds

An attacker creates a specially crafted PDF containing repeated malformed cross-reference streams designed to trigger repeated recovery attempts, then supplies the file to any application or service using the vulnerable library; each processing attempt leads to prolonged CPU usage without completing in reasonable time.

How to fix it

Upgrade pypdf to version 6.21.2 or later, which contains the complete fix for the cross-reference recovery logic.

How to confirm the fix worked

Confirm the installed pypdf version is at least 6.21.2; test with known malformed cross-reference PDFs to verify processing completes promptly without excessive runtime.

Typical attack path

  1. Identify a target application or service that accepts and processes PDF files using pypdf
  2. Craft a PDF containing repeated malformed cross-reference entries that defeats the recovery cache
  3. Deliver the malicious PDF to the target via upload, email attachment, or automated ingestion
  4. Trigger repeated parsing attempts to amplify resource consumption and induce denial of service

How to detect it

Review application logs for unusually long PDF parsing durations or high CPU events correlated with PDF ingestion; examine process execution times and resource metrics around PDF handling routines.

What your security team should do

  • Prioritize upgrade of pypdf to 6.21.2 or newer in all environments that process PDFs
  • Implement input validation or sandboxing for PDF processing until the library is updated
  • Monitor CPU and memory usage on PDF-handling services for anomalous spikes

The record

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities