pypdf: Denial of service via crafted cross-reference streams causing long runtimes
Summary
pypdf, a pure-Python PDF library, is affected by an incomplete fix for an earlier issue (GHSA-55h5-xmcq-c37v). Crafted cross-reference streams with repeated malformed entries can force a complete reload of the PDF stream during each recovery attempt, even when a recovery cache is present. An attacker can use a crafted PDF to cause very long processing times, which results in denial of service; confidentiality and integrity are not affected. Exploitation requires that an application processes the untrusted PDF and, according to the CVSS vector, user interaction.
Affected
- pypdf versions before 6.21.2 (py-pdf pypdf, affected < 6.21.2)
Fixed in
- pypdf 6.21.2
- Newer upstream releases are available; check the current release before choosing a target version.
- Unknown: whether vendor backports for older release lines exist from the upstream project.
Workaround
- Upgrade to pypdf 6.21.2 or later.
- If an upgrade is not possible yet, the upstream project refers to the changes in PR #4240; applying them requires a developer and is not a configuration setting.
- No configuration workaround is documented.
Exploitation
- No known exploitation in the wild.
- No public proof-of-concept known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- CISA KEV status: Unknown.
Our recommendation
- Identify all applications and services that use pypdf, including embedded copies in other software.
- Upgrade to pypdf 6.21.2 or later and test the application before rollout.
- Restrict or monitor services that process PDFs from untrusted sources, and set processing timeouts where possible.
- Monitor the upstream advisory GHSA-jr96-gvgh-j3r4 for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream commit 68a0e50 github.com
- Upstream pull request #4240 github.com
- pypdf release 6.21.2 github.com
- GitHub security advisory GHSA-jr96-gvgh-j3r4 github.com
- Ubuntu CVE-2026-115585 ubuntu.com
- OSV ROOT-APP-PYPI-CVE-2026-115585 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 09:13.
Original description (NVD)
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.