CVE-2026-113791: pypdf content stream parsing can consume excessive memory
Summary
CVE-2026-113791: Crafted PDF files can cause excessive memory consumption during parsing, potentially exhausting resources and disrupting application availability. Affects pypdf versions < 6.21.0. Fixed in 6.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python package in the PyPI ecosystem for working with PDF files. Applications use it to parse and process PDF documents, including their content streams. This advisory concerns memory use while parsing streams containing many small operations, so applications that process PDFs may be exposed when they handle crafted documents.
Vulnerability Detail
A crafted PDF can cause excessive memory consumption when pypdf parses content streams containing many small operations, potentially exhausting resources and disrupting application availability. The issue is a resource exhaustion vulnerability associated with uncontrolled resource consumption. The affected range begins at the initial release and ends before the fixed release. The advisory identifies CWE-400 and CWE-770; it does not describe data disclosure or modification.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.21.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.21.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Documented workaround: pypdf users who cannot upgrade can consider applying the changes from PR #4218. The advisory does not provide a command or code snippet for applying those changes.
Conclusion
Upgrade pypdf to 6.21.0 to address the excessive memory use triggered by crafted PDF content streams. If an upgrade is not currently possible, the advisory points to PR #4218 as a documented workaround. Review applications that parse untrusted PDFs and confirm their dependency records. Vulert monitors the dependencies in Pipfile.lock and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for pypdf →
FAQ
pypdf versions from the initial release up to, but not including, 6.21.0 are affected by CVE-2026-113791.
An attacker can provide a crafted PDF that causes pypdf to use excessive memory while parsing content streams.
Upgrade pypdf to the minimum fixed version, 6.21.0, using the supplied package installation command.
Consider applying the documented changes from pypdf PR #4218 until you can upgrade to the fixed release.
Check Pipfile.lock manually for the pypdf dependency. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
