Live › vulnerability › CVE-2026-113789
Go to dashboardpypdf can be made to use a lot of memory or run for a very long time when code retrieves the form fields of a crafted PDF. An attacker who can get a malicious PDF processed by your app can cause slowdowns or memory exhaustion (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.0 | 6.21.0 |
Run pip show pypdf or pip freeze | grep -i pypdf and check whether the version is below 6.21.0.
Search your code for calls that retrieve form fields (for example get_fields or get_form_text_fields) on untrusted PDFs.
6.21.0 or later (pip install -U "pypdf>=6.21.0")Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.
This has been fixed in pypdf==6.21.0.
If you cannot upgrade yet, consider applying the changes from PR #4219.
This page as .md · .json · in your agent: get_signal("CVE-2026-113789")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.