CVE-2026-113791: pypdf: Possible large memory usage when parsing content streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4218.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0-1 - Upgrade
Upgrade
debian/pypdfto a version that resolves this vulnerability.Fixed in 6.21.4-1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.0
Event History
Frequently Asked Questions
Who can trigger the excessive memory use?
An attacker who can provide a crafted PDF that your application parses with pypdf can trigger it. The PDF uses a content stream containing many small operations.
Which pypdf versions need remediation?
Versions prior to 6.21.0 are affected. Upgrade to version 6.21.0 or later to obtain the fix.