Live › vulnerability › CVE-2026-113791
Go to dashboardpypdf, a Python PDF library, uses large amounts of memory when parsing PDF content streams with many small operations. An attacker who supplies a crafted PDF can exhaust memory in the process that parses it, causing slowdown or a crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.0 | 6.21.0 |
Run pip show pypdf or check the lockfile for the installed pypdf version; anything below 6.21.0 is affected.
6.21.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.
This has been fixed in pypdf==6.21.0.
If you cannot upgrade yet, consider applying the changes from PR #4218.
This page as .md · .json · in your agent: get_signal("CVE-2026-113791")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.