CVE-2026-115585GHSA-jr96-gvgh-j3r4
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
py-pdf pypdfpipLibraries & packages
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- 🚨 CVE-2026-115585 pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still Telegram: CVE Notify, 23 Oct 2026
- @cve.skyfleet.blue: CVE-2026-115585 - pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) CVE ID : CVE-2026-115585 Published : Oct. 23, 2026, 7:31 p.m. | 26 minuteBluesky: CVE posts, 23 Oct 2026
Description
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.
Patches
This has been fixed in pypdf==6.21.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4240.
Notes
This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.
Text from GitHub Advisory Database
Affected versions 53
- pypdf, pip< 6.21.2GitHub
- pypdfaffected: < 6.21.2CVE List
- pypdf, PyPIfrom first release, fixed in 6.21.2OSV
- pypdf, PyPI1.0OSV
- pypdf, PyPI1.1OSV
- pypdf, PyPI1.10OSV
- pypdf, PyPI1.11OSV
- pypdf, PyPI1.12OSV
- pypdf, PyPI1.13OSV
- pypdf, PyPI1.2OSV
- pypdf, PyPI1.3OSV
- pypdf, PyPI1.4OSV
- pypdf, PyPI1.5OSV
- pypdf, PyPI1.6OSV
- pypdf, PyPI1.7OSV
- pypdf, PyPI1.8OSV
- pypdf, PyPI1.9OSV
- pypdf, PyPI3.1.0OSV
- pypdf, PyPI3.10.0OSV
- pypdf, PyPI3.11.0OSV
- pypdf, PyPI3.11.1OSV
- pypdf, PyPI3.12.0OSV
- pypdf, PyPI3.12.1OSV
- pypdf, PyPI3.12.2OSV
- pypdf, PyPI3.13.0OSV
- pypdf, PyPI3.14.0OSV
- pypdf, PyPI3.15.0OSV
- pypdf, PyPI3.15.1OSV
- pypdf, PyPI3.15.2OSV
- pypdf, PyPI3.15.3OSV
- pypdf, PyPI3.15.4OSV
- pypdf, PyPI3.15.5OSV
- pypdf, PyPI3.16.0OSV
- pypdf, PyPI3.16.1OSV
- pypdf, PyPI3.16.2OSV
- pypdf, PyPI3.16.3OSV
- pypdf, PyPI3.16.4OSV
- pypdf, PyPI3.17.0OSV
- pypdf, PyPI3.17.1OSV
- pypdf, PyPI3.17.2OSV
- pypdf, PyPI3.17.3OSV
- pypdf, PyPI3.17.4OSV
- pypdf, PyPI3.2.0OSV
- pypdf, PyPI3.2.1OSV
- pypdf, PyPI3.3.0OSV
- pypdf, PyPI3.4.0OSV
- pypdf, PyPI3.4.1OSV
- pypdf, PyPI3.5.0OSV
- pypdf, PyPI3.5.1OSV
- pypdf, PyPI3.5.2OSV
- pypdf, PyPI3.6.0OSV
- pypdf, PyPI3.7.0OSV
- pypdf, PyPI3.7.1OSV
References 5
- github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4bFixvia CVE List
- github.com/py-pdf/pypdf/releases/tag/6.21.2Fixvia CVE List
- github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4Advisoryvia CVE List
- github.com/advisories/GHSA-jr96-gvgh-j3r4Advisoryvia GitHub
- github.com/py-pdf/pypdf/pull/4240Referencevia CVE List