CVE-2026-115572: pypdf: Possible long runtimes for repeated references to the same missing object

Q: Which deployments are exposed to this issue?

Applications using pypdf versions prior to 6.21.2 are affected when they load relevant portions of an attacker-crafted PDF, such as its pages. The issue is particularly relevant where untrusted PDF files are processed.

Q: What must an attacker do to trigger the long runtime?

The attacker must provide a PDF that repeatedly references the same nonexistent indirect object. Accessing relevant file parts then causes repeated full-file recovery loads and can result in long runtimes.

Q: What can be done if an immediate upgrade is not possible?

Apply the changes from PR #4240 as a workaround. The available permanent fix is upgrading pypdf to version 6.21.2.

Published Oct 23, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4240.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.21.2

pip/pypdf<6.21.2

6.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2

Event History

Oct 23, 2026

CVE Published

via MITRE·07:24 PM

Data Sourced

via MITRE·07:24 PM

DescriptionWeakness

Advisory Published

via GitHub·08:55 PM

Data Sourced

via GitHub·08:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using pypdf versions prior to 6.21.2 are affected when they load relevant portions of an attacker-crafted PDF, such as its pages. The issue is particularly relevant where untrusted PDF files are processed.

What must an attacker do to trigger the long runtime?

The attacker must provide a PDF that repeatedly references the same nonexistent indirect object. Accessing relevant file parts then causes repeated full-file recovery loads and can result in long runtimes.

What can be done if an immediate upgrade is not possible?

Apply the changes from PR #4240 as a workaround. The available permanent fix is upgrading pypdf to version 6.21.2.

CVE-2026-115572: pypdf: Possible long runtimes for repeated references to the same missing object

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the long runtime?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the long runtime?

What can be done if an immediate upgrade is not possible?