CVE-2026-113790: pypdf: Possible large memory usage when parsing arrays and dictionaries
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4218.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0-1 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.4-1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4218 to mitigate large memory usage when parsing arrays or dictionaries with many elements.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use pypdf versions earlier than 6.21.0 to parse PDFs supplied by an attacker are exposed. The attacker-controlled PDF must contain arrays or dictionaries with many elements.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted PDF that the affected application parses with pypdf. The crafted arrays or dictionaries cause the parser to consume large amounts of memory.
How can I remediate the issue?
Upgrade pypdf to version 6.21.0, which fixes the issue.