Multiple security vulnerabilities have been identified in pypdf, a Python library for processing PDF documents. The issues affect pypdf versions below 6.21.0 and can be triggered by maliciously crafted PDF files. They primarily create denial-of-service risk through excessive memory consumption or prolonged processing when the library parses document structures. The overall risk is moderate, especially for applications that process untrusted PDF content.
CVE-2026-113791 (CVSS 6.0 — Medium): This flaw occurs in pypdf content stream parsing, where a crafted PDF can contain many small operations. A remote attacker can supply such a document to cause excessive memory usage during processing.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in pypdf, a Python library for processing PDF documents. The issues affect pypdf versions below 6.21.0 and can be triggered by maliciously crafted PDF files. They primarily create denial-of-service risk through excessive memory consumption or prolonged processing when the library parses document structures. The overall risk is moderate, especially for applications that process untrusted PDF content.
CVE-2026-113791 (CVSS 6.0 — Medium): This flaw occurs in pypdf content stream parsing, where a crafted PDF can contain many small operations. A remote attacker can supply such a document to cause excessive memory usage during processing.[emaillocker id="1283"]
CVE-2026-113790 (CVSS 6.0 — Medium): This flaw occurs in pypdf parsing of arrays and dictionaries, where a crafted PDF can include structures that consume large amounts of memory. A remote attacker can supply such a document to cause excessive memory usage during processing.
CVE-2026-113789 (CVSS 6.0 — Medium): This flaw occurs when pypdf retrieves form fields, where a crafted PDF can cause long runtimes and large memory usage. A remote attacker can supply such a document to create denial-of-service conditions during processing.
These vulnerabilities collectively present a moderate denial-of-service risk for software that processes untrusted PDF documents with the affected library. Users and services that accept PDFs from external sources are most at risk. The general action is to treat untrusted PDF input as potentially abusive and ensure resource consumption remains bounded.
We recommend you to update pypdf to version 6.21.0 to address Vulnerability.
The following reports contain further technical details:
[/emaillocker]