pypdf: Crafted PDFs with repeated malformed cross-reference entries cause long runtimes / DoS (CVE-2026-115585)
Severity: high · Patch status: patched · Since 2026-10-21 · CVE-2026-115585
A follow-up advisory (GHSA-jr96-gvgh-j3r4) for pypdf describes a denial-of-service flaw where an attacker can craft a PDF with cross-reference streams containing repeated malformed cross-reference entries, causing long runtimes when parsed. It is a follow-up to GHSA-55h5-xmcq-c37v, whose fix still reloaded the whole stream despite caching. All pypdf versions before 6.21.2 are affected; any service parsing untrusted PDFs with pypdf is exposed. No in-the-wild exploitation is reported. Fixed in pypdf 6.21.2 (commit 68a0e50, PR 4240); organisations unable to upgrade can apply the PR 4240 changes as a workaround.
What to do
- Upgrade pypdf to 6.21.2 or later wherever it parses untrusted PDFs
- If immediate upgrade is not possible, apply the changes from upstream PR #4240
- Audit dependencies and services that process user-supplied PDF files for exposure
- Add timeouts/resource limits around PDF parsing to blunt DoS attempts
Fixed versions
Sources
All live incidents on Threat Watch