CVE-2026-115580
published 2026-10-23CVE-2026-115580: pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared…
PriorityP337high7.1CVSS 4.0
AVNACLATNPRNUIPVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.41%
35.0th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform | automation-orchestrator-backend-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.21.2 | 6.21.2 |
| pypdf_project | pypdf | >= 0 < 6.21.2 | 6.21.2 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
py-pdf pypdf up to 6.21.1 resource consumption
vuldb·2026-10-23·CVSS 7.1
CVE-2026-115580 [HIGH] py-pdf pypdf up to 6.21.1 resource consumption
A vulnerability categorized as problematic has been discovered in py-pdf pypdf up to 6.21.1. The affected element is an unknown function. Such manipulation leads to resource consumption.
This vulnerability is traded as CVE-2026-115580. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
pypdf: Possible long runtimes for large xref table header limits
ghsa·2026-10-23
CVE-2026-115580 [HIGH] CWE-834 pypdf: Possible long runtimes for large xref table header limits
pypdf: Possible long runtimes for large xref table header limits
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
### Patches
This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).
Red Hat
pypdf: pypdf: Denial of Service via excessive cross-reference table entries
vendor_redhat·2026-10-23·CVSS 7.1
CVE-2026-115580 [HIGH] CWE-606 pypdf: pypdf: Denial of Service via excessive cross-reference table entries
pypdf: pypdf: Denial of Service via excessive cross-reference table entries
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
A flaw was found in pypdf. A remote attacker can cause a Denial of Service (DoS) by convincing a user or automated system to process a specially crafted PDF document. By specifying an excessively large entry count in the document's cross-reference table, the file triggers prolonged processing loops and excessive resource consumption, rendering the application unresponsive.
Package: ansible-automation-plat
No detection rules found.
No public exploits indexed.
2026-10-23
Published