CVE-2026-113791: pypdf: Possible large memory usage when parsing content streams

Q: Who can trigger the excessive memory use?

An attacker who can provide a crafted PDF that your application parses with pypdf can trigger it. The PDF uses a content stream containing many small operations.

Q: Which pypdf versions need remediation?

Versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 or later to obtain the fix.

Published Oct 21, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

Affected Software

1 affected component

pypi/pypdf<6.21.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.0

Event History

Oct 21, 2026

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

DescriptionWeakness

Frequently Asked Questions

Who can trigger the excessive memory use?

An attacker who can provide a crafted PDF that your application parses with pypdf can trigger it. The PDF uses a content stream containing many small operations.

Which pypdf versions need remediation?

Versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 or later to obtain the fix.

CVE-2026-113791: pypdf: Possible large memory usage when parsing content streams

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can trigger the excessive memory use?

Which pypdf versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the excessive memory use?

Which pypdf versions need remediation?