VDB
CVE-2026-115580
CVE-2026-115580
PUBLISHED
CVSS 7.1 HIGH
Reported by GitHub_M · Published October 23, 2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.
Risk Scores
CVSS 4.0
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| py-pdf | pypdf | < 6.21.2 |
| chainguard | open-webui | 0 |
| wolfi | open-webui | 0 |
| PyPI | pypdf | 0 |
| py-pdf | pypdf | 0 |
Timeline
- Oct 23, 2026 CVE Published
- Oct 23, 2026 Coalition ESS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 29, 2026 CVE Updated
- Oct 30, 2026 Security Advisory
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5 x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/pull/4239 x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2 x_refsource_MISC
- https://github.com/py-pdf/pypdf/releases/tag/6.21.2 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-115580 advisory
- https://github.com/advisories/GHSA-gmh7-3g9r-mjh5 advisory