CVE-2026-113790

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in pypdf PDF Parsing

Publication date: 2026-10-21

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113790

EUVD

EUVD-2026-107330

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in the pypdf library allows an attacker to craft a PDF file containing arrays or dictionaries with excessive elements. When parsed, this causes the library to consume large amounts of memory, potentially leading to system slowdowns or crashes.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf installed on your system. Run: pip show pypdf. If the version is below 6.21.0, the system is vulnerable. Additionally, monitor for excessive memory usage during PDF processing, which may indicate exploitation attempts.

Impact Analysis

If you process untrusted PDFs using pypdf versions before 6.21.0, an attacker could send a malicious PDF to consume excessive memory on your system. This may cause applications to freeze, crash, or become unresponsive.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks through excessive memory consumption during PDF parsing. Such attacks may disrupt services handling sensitive data, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade pypdf to version 6.21.0 or later using: pip install --upgrade pypdf.
If upgrading is not possible, apply changes from pull request #4218 manually to limit parsing work in PDF streams.
Avoid processing untrusted PDF files until the vulnerability is mitigated.

Hi! I’m here to help you understand CVE-2026-113790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...