CVE-2026-113790: pypdf: Possible large memory usage when parsing arrays and dictionaries

Q: Who is exposed to this issue?

Applications that use pypdf versions earlier than 6.21.0 to parse PDFs supplied by an attacker are exposed. The attacker-controlled PDF must contain arrays or dictionaries with many elements.

Q: What does an attacker need to exploit it?

An attacker needs to provide a specially crafted PDF that the affected application parses with pypdf. The crafted arrays or dictionaries cause the parser to consume large amounts of memory.

Q: How can I remediate the issue?

Upgrade pypdf to version 6.21.0, which fixes the issue.

Published Oct 21, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

Affected Software

1 affected component

pypi/pypdf<6.21.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.0

Event History

Oct 21, 2026

CVE Published

via MITRE·03:35 PM

Data Sourced

via MITRE·03:35 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use pypdf versions earlier than 6.21.0 to parse PDFs supplied by an attacker are exposed. The attacker-controlled PDF must contain arrays or dictionaries with many elements.

What does an attacker need to exploit it?

An attacker needs to provide a specially crafted PDF that the affected application parses with pypdf. The crafted arrays or dictionaries cause the parser to consume large amounts of memory.

How can I remediate the issue?

Upgrade pypdf to version 6.21.0, which fixes the issue.

CVE-2026-113790: pypdf: Possible large memory usage when parsing arrays and dictionaries

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I remediate the issue?