Zero Radar
← feed
HighVulnerabilityCVE-2026-115580updated 25 Oct 2026, 13:32 UTC

pypdf slows to a crawl on specially crafted PDF files

A malicious PDF file can make the program that opens it run for a very long time, tying up the computer. It does not say the file takes control of your system.

Fixed in pypdf 6.21.2Official, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespypdf 6.21.2 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts PDFXref table declares more entries than exist
  2. 2PDF is deliveredVia upload, email, or download
  3. 3App opens file with pypdfParser processes the xref table
  4. 4Excessive processingRuntime grows far beyond normal
  5. ResultProcessing stalls, service slows or hangs

What happened

pypdf, a Python PDF library, mishandles standard cross-reference (xref) tables whose declared entry count exceeds what the file contains, causing excessive processing when opened.

Why it is dangerous: A crafted PDF can cause long runtimes (denial of service) in any application that parses PDFs with pypdf, such as automated document pipelines or upload-processing services.

Are you affected?

You are affected if you use pypdf older than 6.21.2 to open or process PDF files, including PDFs from untrusted sources.

Package / productAffected versionsFixed in
pypdf · pip< 6.21.26.21.2

What to do

  1. Update pypdf to 6.21.2 or later (pip install --upgrade pypdf)
  2. If you cannot upgrade yet, apply the changes from PR #4239 in the pypdf repository
  3. Limit or time out PDF processing for files from untrusted sources until patched

Timeline

  1. 23 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 20:54 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5
CVSS
7.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pypdf slows to a crawl on specially crafted PDF files · Zero Radar