CVE-2026-113795
Analyzed Analyzed - Analysis Complete

Memory Exhaustion in pypdf PDF Processing

Publication date: 2026-10-21

Last updated on: 2026-11-02

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-11-02
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-113795
EUVD
EUVD-2026-107337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
py-pdf pypdf to 6.20.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113795 is a vulnerability in the pypdf library affecting versions before 6.20.0. It allows an attacker to craft a PDF file that causes excessive memory consumption by using multiple filters or a large number of filters passing significant data during processing.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf installed on your system. Run: pip show pypdf. If the version is below 6.20.0, the system is vulnerable. Additionally, monitor for unusual memory consumption when processing PDF files, as this may indicate exploitation attempts.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive system memory when processing malicious PDF files. It may slow down or crash applications using vulnerable versions of pypdf.

Compliance Impact

This vulnerability primarily causes excessive memory consumption when processing crafted PDF files, which could lead to denial-of-service conditions. While it does not directly violate GDPR or HIPAA, it may impact compliance by disrupting system availability or integrity if exploited in systems handling sensitive data. Organizations must ensure their PDF processing libraries are updated to mitigate such risks.

Mitigation Strategies
  • Upgrade pypdf to version 6.20.0 or later using: pip install --upgrade pypdf.
  • If upgrading is not possible, apply changes from pull request #4173 manually to limit stream processing resources.
  • Restrict PDF processing from untrusted sources to reduce exposure to crafted files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...