CVE-2026-113795 in pypdf
Summary
by MITRE • 10/21/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the pypdf library represents a significant resource exhaustion risk stemming from improper handling of complex PDF stream structures. As an open-source Python library designed for parsing and manipulating Portable Document Format files, pypdf is frequently utilized in applications that process user-uploaded documents or automate document workflows. The core issue lies in how the parser manages memory allocation when encountering crafted PDF streams containing a high volume of filters or multiple nested filter operations. In standard operation, PDF parsers are expected to handle legitimate file structures efficiently; however, attackers can exploit this by constructing malicious files with deeply nested or excessively numerous compression and encoding layers. When such a stream is processed, the library fails to adequately limit memory consumption during the decompression and filtering stages, leading to unbounded resource usage that can degrade system performance or cause application crashes.
From a technical perspective, this flaw aligns closely with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption. The vulnerability allows an attacker to trigger excessive memory allocation by forcing the parser to resolve complex filter chains without appropriate safeguards against depth limits or total data size constraints. This behavior is characteristic of a Denial of Service (DoS) attack vector, specifically categorized under MITRE ATT&CK technique T1496: Resource Hijacking. By consuming disproportionate amounts of system memory relative to the file size or processing time, an attacker can effectively render the hosting application unresponsive or cause it to terminate unexpectedly due to out-of-memory conditions. This is particularly dangerous in server-side environments where pypdf might be used for bulk document processing, as a single malicious upload could impact other users sharing the same resources through resource starvation.
The operational impact of this vulnerability extends beyond simple application instability. In production environments, such memory exhaustion can lead to cascading failures if the affected process is part of a larger microservices architecture or web server cluster. It may also result in data loss if critical operations are interrupted mid-execution due to system-level resource limits being hit. Furthermore, persistent exploitation could facilitate more severe attacks by exhausting available memory for legitimate processes, thereby creating opportunities for privilege escalation or other secondary exploits that rely on the instability of the underlying operating environment. The lack of strict bounds checking during filter resolution means that even moderately sized but complexly structured PDFs can trigger these conditions if they contain enough nested layers to overwhelm the parser's internal buffers and allocation mechanisms.
Mitigation strategies primarily involve upgrading to version 6.20.0 or later, where this issue has been addressed through improved resource management logic within the stream parsing module. For organizations unable to immediately upgrade, implementing strict input validation on uploaded PDF files is recommended as a compensatory control. This includes limiting file sizes and employing sandboxed environments with memory limits for any processes that parse untrusted documents. Additionally, integrating web application firewalls or custom middleware to detect anomalous patterns in incoming document uploads can help mitigate the risk of exploitation until patches are fully deployed across all affected systems. Regular security audits and dependency updates remain essential practices to maintain resilience against such resource-based vulnerabilities in widely used libraries like pypdf.