CVE-2026-115580: pypdf: Possible long runtimes for large xref table header limits

Q: Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.2 are affected when they open attacker-crafted PDF files. The problematic files use a standard cross-reference table with a declared entry count larger than the file can contain.

Q: What must an attacker do to trigger the excessive runtime?

An attacker must cause a crafted PDF with large or incorrect upper limits in its xref table to be opened by pypdf. The result is excessive processing and long runtimes.

Q: What should be done if upgrading is not immediately possible?

Apply the changes from PR #4239 as a workaround. Upgrading pypdf to version 6.21.2 fixes the issue.

Published Oct 23, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4239.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.21.2

pip/pypdf<6.21.2

6.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Compensating control
If upgrading is not yet possible, apply the changes from PR #4239.

Event History

Oct 23, 2026

CVE Published

via MITRE·07:29 PM

Data Sourced

via MITRE·07:29 PM

DescriptionWeakness

Advisory Published

via GitHub·08:54 PM

Data Sourced

via GitHub·08:54 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.2 are affected when they open attacker-crafted PDF files. The problematic files use a standard cross-reference table with a declared entry count larger than the file can contain.

What must an attacker do to trigger the excessive runtime?

An attacker must cause a crafted PDF with large or incorrect upper limits in its xref table to be opened by pypdf. The result is excessive processing and long runtimes.

What should be done if upgrading is not immediately possible?

Apply the changes from PR #4239 as a workaround. Upgrading pypdf to version 6.21.2 fixes the issue.

CVE-2026-115580: pypdf: Possible long runtimes for large xref table header limits

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the excessive runtime?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the excessive runtime?

What should be done if upgrading is not immediately possible?