CVE-2026-113789
Received Received - Intake

Memory Exhaustion in PyPDF via Malicious PDF Forms

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-113789
EUVD
EUVD-2026-107327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
py-pdf pypdf < 6.21.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113789 is a vulnerability in the pypdf library affecting versions prior to 6.21.0. It allows an attacker to craft a malicious PDF that causes excessive memory usage or long processing times when retrieving form fields. The issue stems from inefficient handling of form fields, specifically using a list for cycle detection instead of a set, leading to performance degradation and potential denial-of-service conditions.

Detection Guidance

To detect this vulnerability, check the version of pypdf installed on your system using the command 'pip show pypdf'. If the version is below 6.21.0, your system is vulnerable. Additionally, monitor for unusual memory usage or prolonged processing times when handling PDFs with form fields.

Impact Analysis

This vulnerability can impact users by causing applications to consume excessive memory or experience prolonged processing times when processing certain PDF files. This may lead to system slowdowns, crashes, or denial-of-service conditions, particularly in applications that handle untrusted PDF inputs.

Mitigation Strategies

Immediately upgrade pypdf to version 6.21.0 or later using 'pip install --upgrade pypdf'. If upgrading is not possible, apply the changes from pull request #4219 as a temporary workaround. Avoid processing untrusted PDF files until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart