CVE-2026-113790

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.

Patches

This has been fixed in pypdf==6.21.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4218.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

TuxCare rebuilt pypdf to address 6 CVEs. Fixed in 5.9.0.post20+tuxcare.

This update for python-pypdf fixes the following issues:

Changes in python-pypdf:

• CVE-2026-113786: PDF containing image data labeled with the /DCTDecode filter causes Pillow to select and invoke an unintended image parser when the image is loaded (bsc#1286632)
• CVE-2026-113789: crafted PDF causes large memory usage or long runtimes when an application retrieves the document's form fields (bsc#1286633)
• CVE-2026-113790: PDF containing arrays or dictionaries with many elements causes parsing to consume large amounts of memory (bsc#1286634)
• CVE-2026-113791: PDF containing a content stream with many small operations causes parsing to consume large amounts of memory (bsc#1286635)
• CVE-2026-113792: calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process (bsc#1286636)
• CVE-2026-113793: removing an object from a crafted cyclic PDF tree can enter an infinite loop and block the current process (bsc#1286637)
• CVE-2026-113794: incomplete PDF that ends inside a standard cross-reference table causes pypdf to mishandle the unexpected end of file and enter an infinite loop (bsc#1286638)
• CVE-2026-113795: accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption (bsc#1286639)