CVE-2026-113789: pypdf: Possible long runtimes/large memory usage when retrieving form fields

Q: What application behavior is required for exploitation?

The application must retrieve form fields from an attacker-crafted PDF. The reported impact is large memory consumption or long runtimes during that operation.

Q: Which versions are affected and what version fixes the issue?

pypdf versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 to obtain the fix.

Published Oct 21, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

Affected Software

1 affected component

pypi/pypdf<6.21.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.0

Event History

Oct 21, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionWeakness

Frequently Asked Questions

What application behavior is required for exploitation?

The application must retrieve form fields from an attacker-crafted PDF. The reported impact is large memory consumption or long runtimes during that operation.

Which versions are affected and what version fixes the issue?

pypdf versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 to obtain the fix.

CVE-2026-113789: pypdf: Possible long runtimes/large memory usage when retrieving form fields

Affected Software

Remediation

Event History

Frequently Asked Questions

What application behavior is required for exploitation?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What application behavior is required for exploitation?

Which versions are affected and what version fixes the issue?