---
id: CVE-2026-115580
title: 'pypdf: Possible long runtimes for large xref table header limits'
summary: >-
  pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an
  attacker can craft a PDF with a standard cross-reference table whose declared
  entry count exceeds what the file can contain, causing excessive processing
  and lo…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-834
vendor: py-pdf
product: pypdf
affected:
  - pypdf < 6.21.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T18:01:08.614500Z'
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T18:01:23.279Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115580'
references:
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5'
    label: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5'
  - url: 'https://github.com/py-pdf/pypdf/pull/4239'
    label: 'https://github.com/py-pdf/pypdf/pull/4239'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2
    label: >-
      https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.21.2'
    label: 'https://github.com/py-pdf/pypdf/releases/tag/6.21.2'
  - url: 'https://github.com/py-pdf/pypdf'
  - url: 'https://github.com/advisories/GHSA-gmh7-3g9r-mjh5'
tags:
  - cve.org
  - osv
  - pip
  - ghsa
epss: 0.0041
epssPercentile: 0.35246
aliases:
  - GHSA-gmh7-3g9r-mjh5
ecosystem: pip
patched:
  - pypdf 6.21.2
ingestedAt: '2026-10-23T20:36:51.540Z'
---

## Overview

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

## Affected

- `pypdf < 6.21.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115580)

Affected packages:

- `pypdf < 6.21.2`

Patched in:

- `pypdf 6.21.2`

Source: https://osv.dev/vulnerability/GHSA-gmh7-3g9r-mjh5