Zero Radar
← feed
HighVulnerabilityCVE-2026-115585updated 25 Oct 2026, 13:32 UTC

pypdf can hang on crafted PDF files, causing long processing times

A specially crafted PDF file can make the pypdf Python library run for a very long time while reading it. This can tie up a program or server that processes uploaded or untrusted PDFs.

Fixed in pypdf 6.21.2Official, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespypdf 6.21.2 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts PDFMalformed cross-reference streams inserted
  2. 2PDF uploadedVictim app accepts the file
  3. 3pypdf parses fileRecovery reloads whole stream repeatedly
  4. 4Long runtimeProcessing hangs or slows heavily
  5. ResultService slows or stalls

What happened

pypdf before 6.21.2 incompletely fixed a prior issue with repeated malformed cross-reference entries: during recovery, the full PDF stream is reloaded on each attempt even when a recovery cache exists, so crafted cross-reference streams cause excessive runtime.

Why it is dangerous: An attacker can use a malicious PDF to slow down or stall a service that parses PDFs, reducing availability. Services that accept PDFs from users or the internet are most at risk.

Are you affected?

You are affected if you use pip package pypdf older than 6.21.2 to parse PDF files, especially files from untrusted sources.

Package / productAffected versionsFixed in
pypdf · pip< 6.21.26.21.2

What to do

  1. Update pypdf to version 6.21.2 or later (pip install --upgrade pypdf)
  2. If you cannot upgrade yet, apply the changes from PR #4240 to pypdf
  3. Limit or time-box PDF processing for files from untrusted sources

Timeline

  1. 23 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 20:54 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115585 · GHSA-jr96-gvgh-j3r4
CVSS
7.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pypdf can hang on crafted PDF files, causing long processing times · Zero Radar