CVE-2026-115580 in pypdf
Summary
by MITRE • 10/23/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within pypdf versions prior to 6.21.2 represents a significant resource exhaustion risk stemming from improper validation of PDF structural metadata. As an open-source pure-Python library, pypdf is widely used for parsing and manipulating Portable Document Format files in various automated workflows, including document processing pipelines, archival systems, and content extraction services. The core issue lies in the handling of the cross-reference table, which is a fundamental component of the PDF specification responsible for mapping object offsets within the file to facilitate efficient random access. In vulnerable versions, the parser fails to adequately verify that the number of entries declared in this table corresponds to the actual number of objects present in the document structure.
When an attacker crafts a malicious PDF with a cross-reference table declaring an entry count significantly higher than the actual content size, pypdf attempts to process these non-existent or invalid references during parsing operations such as opening or reading the file. This discrepancy triggers excessive computational overhead as the library iterates through expected entries that do not exist in memory or on disk. The result is a denial of service condition characterized by prolonged execution times and high CPU utilization, effectively rendering the application unresponsive for legitimate users who rely on this functionality. This behavior aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the system fails to limit the amount of resources consumed during input processing.
From a threat modeling perspective, this vulnerability can be leveraged in automated attacks where multiple malicious documents are processed simultaneously, leading to widespread service degradation or complete outage depending on the scale of ingestion. The attack vector is classified under ATT&CK technique T1496, Resource Hijacking, specifically involving CPU consumption for denial-of-service purposes. Because pypdf operates as a library rather than a standalone application with built-in rate limiting or timeout mechanisms by default, applications integrating this library inherit its susceptibility to such resource exhaustion attacks unless additional safeguards are implemented at the integration layer.
The remediation strategy involves upgrading to version 6.21.2 and later, where developers have addressed the parsing logic to enforce strict validation of cross-reference table integrity before processing begins. This ensures that declared entry counts are validated against actual file contents, preventing the parser from entering infinite or excessively long loops based on malformed metadata. For organizations unable to immediately upgrade, implementing external timeouts around pypdf operations and validating PDF structure using more robust parsers prior to ingestion can mitigate the risk of resource exhaustion attacks in production environments.