pypdf: Denial of service via oversized cross-reference table
Summary
pypdf before 6.21.2 does not sufficiently limit the declared entry count of standard cross-reference tables. An attacker can craft a PDF whose xref table declares more entries than the file can contain, which causes excessive processing and long runtimes when the file is opened. The issue affects availability only; no confidentiality or integrity impact is listed. Exploitation requires that a victim or an automated pipeline opens the crafted file.
Affected
- pypdf versions before 6.21.2 (VulDB lists the range as up to 6.21.1)
Fixed in
- 6.21.2 (released 21 Oct 2026)
- Later releases 6.21.3 and 6.21.4 exist; the latest release is recommended. The contents of these later releases were not verified against this CVE.
Workaround
- Unknown. The vendor advisory suggests applying the changes from PR #4239 to your code, which only suits teams that maintain a pinned or forked copy.
- Parse untrusted PDF files in a separate worker process with a timeout and a memory limit, so that one malicious file cannot stall the main application (not a vendor recommendation).
Exploitation
- No known exploitation in the wild as of 1 Nov 2026 (OffSeq: "Not known to be exploited").
- EPSS score: 0.0041.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found in the research; this check is not exhaustive.
Our recommendation
- Upgrade pypdf to the latest release, at least 6.21.2.
- Identify all Python applications that use pypdf, directly or as a transitive dependency, for example with SBOMs, pip show or pip-audit.
- Prioritise internet-facing or customer-facing services that accept uploaded PDFs without authentication, such as invoice intake, online forms or document portals.
- Isolate PDF parsing of untrusted files with timeouts and resource limits.
- Recheck exploitation and proof-of-concept status before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- pypdf release 6.21.2 github.com
- GitHub Security Advisory GHSA-gmh7-3g9r-mjh5 github.com
- Fix commit a3061e3: Limit size of standard xref table github.com
- Pull request #4239: Limit size of standard xref table github.com
- OSV: GHSA-gmh7-3g9r-mjh5 osv.dev
- VulDB entry 426015 vuldb.com
- Ubuntu security notice CVE-2026-115580 ubuntu.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 09:12.
Original description (NVD)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.