---
id: CVE-2026-115585
title: >-
  pypdf: Possible long runtimes for repeated malformed cross-reference entries
  (Follow-up)
summary: >-
  pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an
  incomplete remediation for repeated malformed cross-reference entries in
  GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during
  each recove…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-407
vendor: py-pdf
product: pypdf
affected:
  - pypdf < 6.21.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:56:24.413370Z'
published: '2026-10-23'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:56:32.681Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115585'
references:
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4'
    label: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4'
  - url: 'https://github.com/py-pdf/pypdf/pull/4240'
    label: 'https://github.com/py-pdf/pypdf/pull/4240'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
    label: >-
      https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.21.2'
    label: 'https://github.com/py-pdf/pypdf/releases/tag/6.21.2'
  - url: 'https://github.com/py-pdf/pypdf'
  - url: 'https://github.com/advisories/GHSA-jr96-gvgh-j3r4'
tags:
  - cve.org
  - osv
  - pip
  - ghsa
epss: 0.0041
epssPercentile: 0.35402
aliases:
  - GHSA-jr96-gvgh-j3r4
ecosystem: pip
patched:
  - pypdf 6.21.2
ingestedAt: '2026-10-23T20:36:51.540Z'
---

## Overview

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

## Affected

- `pypdf < 6.21.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115585)

Affected packages:

- `pypdf < 6.21.2`

Patched in:

- `pypdf 6.21.2`

Source: https://osv.dev/vulnerability/GHSA-jr96-gvgh-j3r4