Live › vulnerability › CVE-2026-115580
Go to dashboardpypdf, a Python PDF library, can be made to run for a very long time when it opens a crafted PDF with a large or wrong upper limit in the xref table. An attacker who can get the application to parse such a file can tie up CPU and stall the process (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.2 | 6.21.2 |
pip show pypdf (or pip freeze | grep -i pypdf) and confirm the version is 6.21.2 or newer6.21.2 or newer: pip install --upgrade pypdf>=6.21.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
This has been fixed in pypdf==6.21.2.
If you cannot upgrade yet, consider applying the changes from PR #4239.
This page as .md · .json · in your agent: get_signal("CVE-2026-115580")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.