◆ CVE Hub

CVE-2026-115580

pypdf: Possible long runtimes for large xref table header limits

Published
2026-10-23
Last modified
2026-10-23
CNA
GitHub_M
NVD status
Received
CWE
CWE-834

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
7.1
HIGH
Scored by github.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
7.1
HIGH
Scored by CNA (GitHub_M) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS exploit probability
0.5%
Percentile 43.9%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 4.0 vector
NetworkNo authUser action Confidentiality NIntegrity NAvailability H
MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Attack requirements ATNNone
Privileges required PRNNone
User interaction UIPPassive
Confidentiality (vulnerable system) VCNNone
Integrity (vulnerable system) VINNone
Availability (vulnerable system) VAHHigh
Confidentiality (subsequent systems) SCNNone
Integrity (subsequent systems) SINNone
Availability (subsequent systems) SANNone
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

NVD

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)4.07.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA / GitHub_M4.07.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
py-pdfpypdf
affected: < 6.21.2

Open-source packages (GitHub Advisory / OSV)

GHSA-gmh7-3g9r-mjh5 GHSA HIGH reviewed

pypdf: Possible long runtimes for large xref table header limits

EcosystemPackageAffected versionsFixed in
PyPIpypdf< 6.21.26.21.2

Linux distribution status

Red Hat ↗ moderate

ReleasePackageStatusFixed version / notes
Red Hat Ansible Automation Platform 2ansible-automation-platform-25/lightspeed-chatbot-rhel8out of support scope
Ansible Automation Orchestrator 2026ansible-automation-platform/automation-orchestrator-backend-rhel9fix deferred
Lightspeed Corelightspeed-core/lightspeed-stack-rhel9fix deferred
Lightspeed Corelightspeed-core/rag-tool-cpu-rhel9fix deferred
Lightspeed Corelightspeed-core/rag-tool-cuda-12.9-rhel9fix deferred
OpenShift Lightspeedopenshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9fix deferred
OpenShift Lightspeedopenshift-lightspeed/lightspeed-ocp-rag-rhel9fix deferred
Red Hat Quay 3quay/quay-rhel8out of support scope
Red Hat Quay 3quay/quay-rhel9out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-cuda-rhel9fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-gaudi-rhel9fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-rocm-rhel9fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/disk-image-cuda-rhel9fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-llama-stack-core-rhel9fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-ogx-core-rhel9fix deferred

Debian ↗

ReleasePackageStatusFixed version / notes
bookwormpypdfopen not yet assigned
forkypypdfopen not yet assigned
sidpypdfopen not yet assigned
trixiepypdfopen not yet assigned
bookwormpypdf2open not yet assigned

Ubuntu ↗ Fetching

References (5)