CVE-2026-115585 in pypdf
Summary
by MITRE • 10/23/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as GHSA-55h5-xmcq-c37v within the pypdf library represents a significant denial of service risk stemming from an incomplete remediation effort regarding malformed cross-reference entries in PDF documents. The core technical flaw lies in how the parser handles recovery attempts when encountering corrupted or maliciously crafted cross-reference streams. Specifically, even when a recovery cache is present and should theoretically prevent redundant processing, the logic fails to properly utilize this cache during subsequent parsing iterations. This oversight results in the library repeatedly reloading entire PDF streams for each recovery attempt rather than leveraging previously parsed data or cached states.
This behavior creates an opportunity for attackers to craft specific malicious PDF files containing malformed cross-reference entries that trigger these inefficient recovery loops. When such a document is processed by vulnerable versions of pypdf, specifically those prior to version 6.21.2, the application enters a state of excessive computational activity. The repeated reloading and parsing of large streams consume significant CPU resources and memory over an extended period. This effectively leads to a denial of service condition where legitimate services relying on PDF processing become unresponsive or crash due to resource exhaustion.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to limit the resources consumed during error recovery scenarios. It also relates to CWE-756, Missing Custom Error Handling, because the library does not adequately handle edge cases in malformed input structures, leading to pathological performance degradation rather than graceful failure or efficient retry mechanisms. In terms of offensive security frameworks, this vulnerability can be leveraged within MITRE ATT&CK technique T1496, Resource Hijacking, where an attacker uses minimal resources on their end to cause disproportionate resource consumption and disruption on the target system.
The operational impact of this flaw is primarily centered around service availability rather than data confidentiality or integrity. Systems that ingest PDF files from untrusted sources, such as email gateways, document management systems, or web applications with file upload functionality, are at risk if they utilize vulnerable versions of pypdf for parsing operations. An attacker can exploit this by submitting a specially crafted PDF payload designed to trigger the infinite or near-infinite loop during cross-reference stream recovery. This results in prolonged runtimes that can exhaust server resources, leading to timeouts, application crashes, or degraded performance for other users sharing the same infrastructure.
To mitigate this risk, organizations must upgrade pypdf to version 6.21.2 or later, where the incomplete remediation has been addressed and proper caching mechanisms are enforced during recovery processes. Additionally, defensive measures should include implementing strict input validation and size limits on uploaded PDF files before they reach the parsing engine. Deploying web application firewalls with rules capable of detecting anomalous processing times associated with malformed documents can also provide an additional layer of defense against exploitation attempts targeting this specific resource exhaustion vector.