Zero Radar
← feed
HighVulnerabilityCVE-2026-115572updated 25 Oct 2026, 13:32 UTC

pypdf can hang on specially crafted PDF files

A maliciously built PDF can make the pypdf Python library run for a very long time, slowing or freezing a program that opens it. This can be used to make a service unresponsive.

Fixed in pypdf 6.21.2Official, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespypdf 6.21.2 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts PDFRepeats same missing object reference
  2. 2PDF uploaded or openedApp parses the file with pypdf
  3. 3pypdf recovers fileFull-file reload triggered repeatedly
  4. 4Service slows downLong runtime ties up resources
  5. ResultService becomes slow or unresponsive

What happened

pypdf before 6.21.2 repeatedly performs full-file recovery loads when a PDF references the same non-existent indirect object multiple times, causing excessive runtime when pages or other parts are accessed.

Why it is dangerous: Attackers can submit a crafted PDF to any service that parses PDFs with pypdf, tying up CPU and causing denial of service.

Are you affected?

You are affected if you use pypdf older than 6.21.2 to open or process PDF files, especially files from untrusted sources.

Package / productAffected versionsFixed in
pypdf · pip< 6.21.26.21.2

What to do

  1. Update pypdf to 6.21.2 or later (pip install --upgrade pypdf)
  2. If you cannot upgrade yet, apply the changes from PR #4240 in the pypdf repository
  3. Restrict or timeout PDF processing for untrusted uploads until updated

Timeline

  1. 23 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 20:55 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115572 · GHSA-6c7f-9265-g8fw
CVSS
7.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pypdf can hang on specially crafted PDF files · Zero Radar