CVE-2026-115580

Published: Ott 23, 2026 Last Modified: Ott 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

834

Excessive Iteration

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Amplification Dos: Crash, Exit, Or Restart
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d5…
https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2
https://github.com/py-pdf/pypdf/pull/4239
https://github.com/py-pdf/pypdf/pull/4239
https://github.com/py-pdf/pypdf/releases/tag/6.21.2
https://github.com/py-pdf/pypdf/releases/tag/6.21.2
https://github.com/py-pdf/pypdf/security/advisories/GHSA-gm…
https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5