Excessive Processing Vulnerability in pypdf PDF Library
CVE-2026-115580

7.1HIGH

Key Information:

Vendor

Py-PDF

Status
PyPDF
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115580?

The pypdf library, an open-source pure-Python PDF processing tool, is susceptible to an excessive processing vulnerability due to improper handling of a crafted PDF file. An attacker can leverage this flaw by creating a malicious PDF with a cross-reference table that declares an entry count exceeding the file's capacity, resulting in prolonged processing times and potential performance degradation when the document is accessed. This issue has been remediated in version 6.21.2.

Affected Version(s)

pypdf < 6.21.2

References

https://github.com/py-pdf/pypdf/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/py-pdf/pypdf/pull/4239
x_refsource_MISC
https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.