Live › vulnerability › CVE-2026-113790
Go to dashboardpypdf versions before 6.21.0 can use large amounts of memory when parsing a crafted PDF with arrays or dictionaries containing many elements. An attacker who supplies such a PDF can exhaust memory and cause a denial of service in the process parsing it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.0 | 6.21.0 |
pip show pypdf (or check the lockfile) and look for a version below 6.21.0
6.21.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.
This has been fixed in pypdf==6.21.0.
If you cannot upgrade yet, consider applying the changes from PR #4218.
This page as .md · .json · in your agent: get_signal("CVE-2026-113790")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.