CVE-2026-115580highCWE-834

CVE-2026-115580: high-severity vulnerability in py-pdf pypdf

pypdf: Possible long runtimes for large xref table header limits

Published · Updated

Follow this CVE+ Monitor pypdf+ Monitor pypdf

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
py-pdf · pypdf
Related CVEs — py-pdf pypdf

In the same product, most dangerous first.

CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-59936HIGHpypdf: Possible infinite loop for not terminated inline imagesEPSS 0.6%CVE-2026-59935HIGHpypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)EPSS 0.6%CVE-2026-59937MEDIUMpypdf: Possible long runtimes for repeated malformed cross-reference entriesEPSS 0.6%CVE-2023-36807MEDIUMInfinite Loop when reading malformed objects in pypdfEPSS 0.6%CVE-2026-82398MEDIUMpypdf: Inefficient handling of non-whitespace inputs in read_until_whitespaceEPSS 0.5%