CVE-2026-115580
pypdf: Possible long runtimes for large xref table header limits
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
pypdf: Possible long runtimes for large xref table header limits
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
CVE-2026-115580- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2026-109129
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
EUVD-2026-109129- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gmh7-3g9r-mjh5
pypdf: Possible long runtimes for large xref table header limits
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
Patches
This has been fixed in pypdf==6.21.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4239.
- Record
GHSA-gmh7-3g9r-mjh5- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
NVD
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
CVE-2026-115580- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-834
- Updated
- 2026-11-02
OSV
pypdf: Possible long runtimes for large xref table header limits
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
CVE-2026-115580- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-115580
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
DEBIAN-CVE-2026-115580- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-06
Show 5 moreShow less
OSVGHSA-gmh7-3g9r-mjh5
pypdf: Possible long runtimes for large xref table header limits
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.
Patches
This has been fixed in pypdf==6.21.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4239.
- Record
GHSA-gmh7-3g9r-mjh5- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
OSVRHLW-2026-8c3fe2e9e5dcb600
Lightwell Security Advisory: pypdf 6.21.1+rhlw.1
Red Hat Lightwell has released pypdf 6.21.1+rhlw.1 with backported fixes for CVE-2026-115585, CVE-2026-115572, and CVE-2026-115580.
CVE-2026-115585: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-115572: pypdf: Possible long runtimes for repeated references to the same missing object
CVE-2026-115580: pypdf: Possible long runtimes for large xref table header limits
This patched artifact is a drop-in replacement for pypdf 6.21.1 from PyPI.
- Record
RHLW-2026-8c3fe2e9e5dcb600- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-115580
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
- Record
UBUNTU-CVE-2026-115580- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVCLSA-2026-1793015443 No score
TuxCare security update for pypdf (6 CVEs)
TuxCare rebuilt pypdf to address 6 CVEs. Fixed in 5.9.0.post20+tuxcare.
- Record
CLSA-2026-1793015443- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-115580 No score
CVE-2026-115580 in pypdf - Patched by Root
Root has patched CVE-2026-115580 in the pypdf package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-115580- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pypdfPyPI |
before 6.21.2 | 6.21.2 |
pypdfTuxCare:PyPI From an advisory covering 6 CVEs |
5.9.0 up to 5.9.0.post20+tuxcare, plus listed versions 5.9.0.post1+tuxcare5.9.0.post10+tuxcare5.9.0.post11+tuxcare5.9.0.post12+tuxcare5.9.0.post13+tuxcare Show 14 moreShow less5.9.0.post14+tuxcare5.9.0.post15+tuxcare5.9.0.post16+tuxcare5.9.0.post17+tuxcare5.9.0.post18+tuxcare5.9.0.post19+tuxcare5.9.0.post2+tuxcare5.9.0.post3+tuxcare5.9.0.post4+tuxcare5.9.0.post5+tuxcare5.9.0.post6+tuxcare5.9.0.post7+tuxcare5.9.0.post8+tuxcare5.9.0.post9+tuxcare |
5.9.0.post20+tuxcare |
pypdfDebian:12 |
All versions, plus listed versions 3.17.4-13.4.1-13.4.1-1+deb12u14.0.0-14.0.0-1~exp1 Show 13 moreShow less4.0.1-14.0.2-14.1.0-14.2.0-14.3.1-15.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:13 |
All versions, plus listed versions 5.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:14 |
before 6.21.4-1, plus listed versions 5.4.0-16.19.0-16.21.0-16.21.1-16.9.0-16.9.2-16.9.2-2 |
6.21.4-1 |
pypdf2Debian:12 |
All versions, plus listed versions 2.12.1-32.12.1-3+deb12u12.12.1-4 |
None known |
pypdfPyPI |
before 6.21.2, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.21.31.41.51.61.71.81.93.1.03.10.03.11.03.11.13.12.03.12.13.12.23.13.03.14.03.15.03.15.13.15.23.15.33.15.43.15.53.16.03.16.13.16.23.16.33.16.43.17.03.17.13.17.23.17.33.17.43.2.03.2.13.3.03.4.03.4.13.5.03.5.13.5.23.6.03.7.03.7.1 |
6.21.2 |
pypdfRed Hat Lightwell:PyPI From an advisory covering 3 CVEs |
before 6.21.1+rhlw.1, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.21.31.41.51.61.71.81.93.1.03.10.03.11.03.11.13.12.03.12.13.12.23.13.03.14.03.15.03.15.13.15.23.15.33.15.43.15.53.16.03.16.13.16.23.16.33.16.43.17.03.17.13.17.23.17.33.17.43.2.03.2.13.3.03.4.03.4.13.5.03.5.13.5.23.6.03.7.03.7.1 |
6.21.1+rhlw.1 |
pypdfRoot:PyPI |
before 6.18.1+aikido.4 | 6.18.1+aikido.46.16.2+aikido.7 |
pypdfUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.1-13.17.4-14.0.0-14.0.1-14.0.2-1 |
None known |
pypdfUbuntu:26.10 |
All versions, plus listed versions 6.9.2-16.9.2-2 |
None known |
pypdfUbuntu:26.04:LTS |
All versions, plus listed versions 5.4.0-16.9.2-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| affected | OSV | |
| facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115580 is a high vulnerability (CVSS 7.1) in Py-pdf Pypdf, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in pypdf 6.21.2.
References
github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-115580
security-tracker.debian.org/tracker/CVE-2026-115580
ubuntu.com/security/CVE-2026-115580
cve.org/CVERecord?id=CVE-2026-115580
Left out here: 148 versions. The JSON record has them.