Live › vulnerability › CVE-2026-115572
Go to dashboardpypdf, a Python PDF library, takes a very long time to process a crafted PDF that references the same missing object many times. An attacker who gets such a file in front of your parser can tie up CPU and stall the worker (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.2 | 6.21.2 |
pip show pypdf (or check requirements/lock files) and look for a version below 6.21.2.
6.21.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.
This has been fixed in pypdf==6.21.2.
If you cannot upgrade yet, consider applying the changes from PR #4240.
This page as .md · .json · in your agent: get_signal("CVE-2026-115572")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.