CVE-2026-113790: Uncontrolled Resource Consumption in pypdf Container Parsing
Vulnerability ID: CVE-2026-113790
CVSS Score: 6.0
Published: 2026-10-22
A Denial of Service (DoS) vulnerability in pypdf versions prior to 6.21.0 allows remote attackers to cause high CPU and memory resource exhaustion by supplying PDF files containing oversized or deeply nested arrays, dictionaries, or content streams.
TL;DR
pypdf versions prior to 6.21.0 lack upper element bounds and cumulative token limits when deserializing PDF arrays, dictionaries, and streams. Attackers can submit malformed PDFs to trigger high CPU usage and out-of-memory process crashes.
Technical Details
- CWE ID: CWE-400 (Uncontrolled Resource Consumption)
- CVSS v4.0: 6.0 (Medium)
- Attack Vector: Network (AV:N)
- EPSS Score: 0.00317 (23.44th percentile)
- Impact: Denial of Service (High Memory / CPU Resource Exhaustion)
- Exploit Status: Proof of Concept / Test Suite Code Available
- CISA KEV Status: Not Listed
Affected Systems
- pypdf versions prior to 6.21.0
- Python web services and document processing pipelines ingesting untrusted PDF files via pypdf
Mitigation Strategies
- Upgrade pypdf to version 6.21.0 or higher.
- Define strict operational parsing quotas using apply_configuration when parsing untrusted uploads.
- Enforce process-level execution timeouts and memory memory cgroups for worker processes handling document extraction.
Remediation Steps:
- Update package management requirements (pyproject.toml or requirements.txt) to enforce pypdf>=6.21.0.
- Run pip install --upgrade pypdf in deployment pipelines.
- Wrap document ingestion code in LimitReachedError exception handling logic to reject malicious documents cleanly.
Read the full report for CVE-2026-113790 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)