CVE-2026-115572 in pypdf
Summary
by MITRE • 10/23/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within pypdf versions prior to 6.21.2 represents a significant resource exhaustion risk stemming from inefficient handling of malformed PDF structures. As an open-source pure-Python library, pypdf is widely used for parsing and manipulating Portable Document Format files in various automated workflows, including document processing pipelines, archival systems, and content management platforms. The core issue lies in the parser's inability to efficiently detect or handle circular references involving nonexistent indirect objects. When a crafted PDF contains repeated references to an indirect object that does not exist within the file structure, the library attempts to resolve these references repeatedly rather than failing fast or caching the resolution attempt. This behavior triggers a recursive or iterative loop where the parser continuously loads and processes relevant parts of the file, such as page streams, in an effort to locate the missing data.
From a technical perspective, this flaw allows for a Denial of Service attack against applications relying on pypdf for PDF processing. An attacker can construct a maliciously crafted PDF document that exploits this parsing logic by embedding multiple indirect object references pointing to non-existent entities. Upon attempting to access or parse such a file, the library enters an infinite or excessively long execution loop as it repeatedly attempts full-file recovery loads. This results in prolonged CPU usage and potential memory exhaustion, effectively rendering the application unresponsive or causing it to crash due to resource constraints. The impact is particularly severe in server-side environments where PDF processing occurs on demand, as a single malicious upload can consume all available computational resources for that process instance, potentially affecting other users or services sharing the same infrastructure.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting through excessive resource consumption during parsing operations. In terms of attack classification under the MITRE ATT&CK framework, this behavior is consistent with T1496, Resource Hijacking, where an adversary uses compromised or maliciously crafted inputs to consume system resources and degrade service availability for legitimate users. The lack of depth limits in object resolution and insufficient validation of indirect object existence before processing contributes directly to the exploitability of this flaw.
Mitigation strategies primarily involve upgrading pypdf to version 6.21.2 or later, where the parsing logic has been corrected to prevent these repeated recovery loads. For environments that cannot immediately upgrade, implementing input sanitization at the application layer is recommended. This includes validating PDF structures before passing them to the parser and setting strict timeouts for parsing operations to limit the duration of any potential infinite loops. Additionally, deploying rate limiting on endpoints that accept user-uploaded PDFs can help mitigate the impact by restricting the frequency of processing requests from a single source. Security teams should also consider implementing resource quotas at the container or process level to ensure that even if such an attack is successful, it does not compromise the stability of the broader system infrastructure.