p PatchFirst

CVE-2026-115580

CVE-2026-115580 · pypdf: Possible long runtimes for large xref table header limits

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pypdf

    Versions
    • < 6.21.2: Affected

    No fix published

  • pypdf Debian:12

    Versions
    • 3.17.4-1
    • 3.4.1-1
    • 3.4.1-1+deb12u1
    • 4.0.0-1
    • 4.0.0-1~exp1
    • 4.0.1-1
    • 4.0.2-1
    • 4.1.0-1
    • 4.2.0-1
    • 4.3.1-1
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.21.1-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:13

    Versions
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.21.1-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:14

    Versions
    • 5.4.0-1
    • 6.19.0-1
    • 6.21.0-1
    • 6.21.1-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Debian:12

    Versions
    • 2.12.1-3
    • 2.12.1-3+deb12u1
    • 2.12.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf PyPI

    Versions
    • 1.0
    • 1.1
    • 1.10
    • 1.11
    • 1.12
    • 1.13
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.8
    • 1.9
    • 3.1.0
    • 3.10.0
    • 3.11.0
    • 3.11.1
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.14.0
    • 3.15.0
    • 3.15.1
    • 3.15.2
    • 3.15.3
    • 3.15.4
    • 3.15.5
    • 3.16.0
    • 3.16.1
    • 3.16.2
    • 3.16.3
    • 3.16.4
    • 3.17.0
    • 3.17.1
    • 3.17.2
    • 3.17.3
    • 3.17.4
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.4.0
    • 3.4.1
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.7.0
    • 3.7.1
    • 3.8.0
    • 3.8.1
    • 3.9.0
    • 3.9.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.5.0
    • 5.6.0
    • 5.6.1
    • 5.7.0
    • 5.8.0
    • 5.9.0
    • 6.0.0
    • 6.1.0
    • 6.1.1
    • 6.1.2
    • 6.1.3
    • 6.10.0
    • 6.10.1
    • 6.10.2
    • 6.11.0
    • 6.12.0
    • 6.12.1
    • 6.12.2
    • 6.13.0
    • 6.13.1
    • 6.13.2
    • 6.13.3
    • 6.14.0
    • 6.14.1
    • 6.14.2
    • 6.15.0
    • 6.16.0
    • 6.16.1
    • 6.16.2
    • 6.17.0
    • 6.18.0
    • 6.18.1
    • 6.19.0
    • 6.2.0
    • 6.20.0
    • 6.20.1
    • 6.21.0
    • 6.21.1
    • 6.3.0
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.6.2
    • 6.7.0
    • 6.7.1
    • 6.7.2
    • 6.7.3
    • 6.7.4
    • 6.7.5
    • 6.8.0
    • 6.9.0
    • 6.9.1
    • 6.9.2
    Affected ranges
    • ECOSYSTEM: < 6.21.2

    Update to 6.21.2

Original sources

Check your server →