CVE-2026-113789: pypdf: Possible long runtimes/large memory usage when retrieving form fields
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4219.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0-1 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.1-1Fixed in 6.21.4-1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4219.
Event History
Frequently Asked Questions
What application behavior is required for exploitation?
The application must retrieve form fields from an attacker-crafted PDF. The reported impact is large memory consumption or long runtimes during that operation.
Which versions are affected and what version fixes the issue?
pypdf versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 to obtain the fix.