Multiple security vulnerabilities have been identified in pypdf, a Python library for processing PDF documents. The issues involve excessive memory consumption and infinite loops while parsing or manipulating crafted PDF files, posing a denial-of-service risk to applications that handle untrusted documents. Some affected version ranges are stated as below 6.20.0 or below 6.20.1, and the overall risk is medium because remote attackers can trigger resource exhaustion or hangs by supplying malicious files.
CVE-2026-113795 (CVSS 6.0 — Medium): A crafted PDF can cause large memory consumption when pypdf processes a stream with multiple filters or filters that pass large amounts of data. A remote attacker can exploit this to exhaust memory and degrade availability.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in pypdf, a Python library for processing PDF documents. The issues involve excessive memory consumption and infinite loops while parsing or manipulating crafted PDF files, posing a denial-of-service risk to applications that handle untrusted documents. Some affected version ranges are stated as below 6.20.0 or below 6.20.1, and the overall risk is medium because remote attackers can trigger resource exhaustion or hangs by supplying malicious files.
CVE-2026-113795 (CVSS 6.0 — Medium): A crafted PDF can cause large memory consumption when pypdf processes a stream with multiple filters or filters that pass large amounts of data. A remote attacker can exploit this to exhaust memory and degrade availability.[emaillocker id="1283"]
CVE-2026-113794 (CVSS 6.0 — Medium): A crafted PDF can trigger an infinite loop when pypdf reaches end-of-file while parsing a standard cross-reference table. A remote attacker can exploit this to cause a hang and deny service.
CVE-2026-113793 (CVSS 6.0 — Medium): A crafted PDF can cause an infinite loop when pypdf removes tree items during document processing. A remote attacker can exploit this to make processing hang and deny service.
CVE-2026-113792 (CVSS 6.0 — Medium): A crafted PDF can cause an infinite loop during outline item lookup in pypdf's writer functionality. A remote attacker can exploit this to hang processing and deny service.
These vulnerabilities collectively present a medium denial-of-service risk to systems that process untrusted PDF files with pypdf. Users and services that accept PDFs from external sources are most at risk, particularly when they parse or modify documents without strict resource controls. The general action is to assess exposure and prioritize risk management for affected deployments.
We recommend you to update pypdf to version 6.20.0 or 6.20.1 depending on the advisory being addressed.
The following reports contain further technical details:
[/emaillocker]