Live › vulnerability › CVE-2026-113795
Go to dashboardpypdf, a Python PDF library, can be made to use large amounts of memory when parsing a stream with many or large chained filters. An attacker who supplies a crafted PDF can exhaust memory in the process that reads it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.20.0 | 6.20.0 |
pip show pypdf or pip freeze | grep -i pypdf, and check whether the version is below 6.20.0.
6.20.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.
This has been fixed in pypdf==6.20.0.
If you cannot upgrade yet, consider applying the changes from PR #4173.
This page as .md · .json · in your agent: get_signal("CVE-2026-113795")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.