CVE-2026-113791

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in PyPDF PDF Parsing

Publication date: 2026-10-21

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113791

EUVD

EUVD-2026-107331

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in the pypdf library allows an attacker to create a malicious PDF file that causes excessive memory usage when parsed. The issue occurs when the PDF contains content streams with many small operations, overwhelming the system during parsing. It affects versions of pypdf before 6.21.0.

Detection Guidance

To detect this vulnerability, check the version of pypdf installed on your system. Run: pip show pypdf. If the version is below 6.21.0, the system is vulnerable. Additionally, monitor for excessive memory usage during PDF processing, which may indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to consume large amounts of memory on a system processing the PDF, potentially leading to denial-of-service conditions. Systems relying on pypdf for PDF processing may slow down or crash if processing untrusted files.

Compliance Impact

This vulnerability primarily involves uncontrolled resource consumption (CWE-400), which could lead to denial-of-service conditions by exhausting system memory. While not directly violating GDPR or HIPAA, such resource exhaustion may impact system availability, potentially affecting services handling sensitive data. Compliance risks arise if the vulnerability enables unauthorized access or disrupts critical operations processing personal or health information.

Mitigation Strategies

Upgrade pypdf to version 6.21.0 or later using: pip install --upgrade pypdf. If upgrading is not possible, apply changes from Pull Request #4218 as a temporary workaround. Ensure PDF processing applications enforce memory limits during parsing.

Hi! I’m here to help you understand CVE-2026-113791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...