Resource exhaustion in PyPDF - CVE-2026-113795
Published: November 3, 2026
Vulnerability identifier: #VU158925
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113795
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption and potentially a denial of service.
The vulnerability exists due to uncontrolled resource consumption in pypdf's PDF stream filter processing when accessing streams with many filters or multiple filters that pass large amounts of data between them. A remote attacker can craft a PDF containing such streams and have it processed by an application using pypdf to cause excessive memory consumption and potentially a denial of service.
Affected software
PyPDF
How to mitigate CVE-2026-113795
Install security update from vendor's website.
PyPDF - update to 6.20.0