SB2026110375 - Resource exhaustion in PyPDF

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110375

SB2026110375 - Resource exhaustion in PyPDF

Published: November 3, 2026

Security Bulletin ID SB2026110375
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Resource exhaustion (CVE-ID: CVE-2026-113795)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause excessive memory consumption and potentially a denial of service.

The vulnerability exists due to uncontrolled resource consumption in pypdf's PDF stream filter processing when accessing streams with many filters or multiple filters that pass large amounts of data between them. A remote attacker can craft a PDF containing such streams and have it processed by an application using pypdf to cause excessive memory consumption and potentially a denial of service.


Remediation

Install update from vendor's website.

References