CVE-2026-113791 in pypdf
Summary
by MITRE • 10/22/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in pypdf prior to version 6.21.0 represents a significant resource exhaustion risk stemming from the library's handling of PDF content streams. As an open-source pure-Python implementation for parsing and manipulating PDF documents, pypdf is widely used in automated document processing pipelines, web applications, and data extraction tools. The core issue lies in how the parser processes complex or maliciously crafted content streams that contain a high volume of small drawing operations. When such a stream is encountered, the library fails to impose adequate limits on memory allocation during the parsing phase, leading to unbounded growth in memory consumption proportional to the number of operations within the stream rather than its actual visual complexity or size.
From a technical perspective, this flaw allows an attacker to craft a PDF file that appears benign but contains thousands or millions of tiny graphical elements such as points, lines, or small paths. While each individual operation may consume negligible resources, the cumulative effect during parsing causes the Python interpreter to allocate excessive amounts of memory for internal data structures representing these operations. This behavior is characteristic of inefficient resource management in document parsers where input validation and size constraints are not strictly enforced before processing begins. The lack of a cap on the number of supported operations or total parsed content stream size means that even moderately sized files with dense graphical instructions can trigger disproportionate memory usage, potentially exhausting available system resources.
The operational impact of this vulnerability is primarily centered around Denial of Service conditions for systems relying on pypdf to process untrusted PDF inputs. In web applications where users upload documents for analysis or conversion, an attacker could submit a specially crafted file that causes the application server to consume all available memory, leading to service crashes, timeouts, or system instability. This is particularly dangerous in cloud environments or containerized deployments where resource limits are critical for stability and cost management. Furthermore, if the affected pypdf instance runs with elevated privileges or handles sensitive documents, the resulting crash could lead to data loss or expose temporary files containing processed content to unauthorized access depending on how the application cleans up after failure.
This vulnerability aligns with Common Weakness Enumeration category CWE-400 which describes uncontrolled resource consumption, specifically within the context of parsing external inputs without proper bounds checking. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Resource Hijacking techniques where attackers leverage software vulnerabilities to consume computational resources and disrupt service availability rather than executing arbitrary code or stealing data directly. The attack vector typically involves supplying a maliciously constructed PDF file through any interface that accepts document uploads for processing by the vulnerable pypdf version.
Mitigation strategies focus primarily on upgrading to patched versions of the library where these parsing limits have been implemented. Organizations should immediately update their dependencies to pypdf version 6.21.0 or later which addresses this memory consumption issue through improved handling of content stream operations. For environments that cannot upgrade immediately, defensive coding practices such as implementing strict file size limits on uploaded documents and using sandboxed execution environments can help mitigate the risk. Additionally integrating input validation layers that inspect PDF structure before passing them to pypdf may provide an additional layer of protection against resource exhaustion attacks targeting document parsing components in software stacks.