CVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

Q: Which deployments are exposed to this issue?

Deployments using pypdf versions before 6.21.2 are affected when they process attacker-controlled PDFs. The issue is triggered by crafted cross-reference streams containing repeated malformed entries.

Q: What does an attacker need to do to exploit it?

An attacker must supply a specially crafted PDF. Processing that PDF can cause pypdf to repeatedly reload the complete PDF stream during recovery attempts, resulting in long runtimes.

Q: What can be done if upgrading is not immediately possible?

Apply the changes from PR #4240 as a workaround. Otherwise, avoid processing untrusted PDFs until pypdf can be updated to version 6.21.2.

Published Oct 23, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

Patches

This has been fixed in pypdf==6.21.2.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4240.

Notes

This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.21.2

pip/pypdf<6.21.2

6.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.2
Compensating control
If you cannot upgrade to pypdf 6.21.2, apply the changes from PR #4240.

Event History

Oct 23, 2026

CVE Published

via MITRE·07:31 PM

Data Sourced

via MITRE·07:31 PM

DescriptionWeakness

Advisory Published

via GitHub·08:54 PM

Data Sourced

via GitHub·08:54 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf versions before 6.21.2 are affected when they process attacker-controlled PDFs. The issue is triggered by crafted cross-reference streams containing repeated malformed entries.

What does an attacker need to do to exploit it?

An attacker must supply a specially crafted PDF. Processing that PDF can cause pypdf to repeatedly reload the complete PDF stream during recovery attempts, resulting in long runtimes.

What can be done if upgrading is not immediately possible?

Apply the changes from PR #4240 as a workaround. Otherwise, avoid processing untrusted PDFs until pypdf can be updated to version 6.21.2.

CVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What can be done if upgrading is not immediately possible?