Live › vulnerability › CVE-2026-115585
Go to dashboardpypdf, a Python PDF library, can take a very long time to process a crafted PDF with repeated malformed cross-reference streams. An attacker who can get such a PDF processed can tie up the process and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.21.2 | 6.21.2 |
pip show pypdf
6.21.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.
This has been fixed in pypdf==6.21.2.
If you cannot upgrade yet, consider applying the changes from PR #4240.
This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.
This page as .md · .json · in your agent: get_signal("CVE-2026-115585")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.