CVE-2026-113789: pypdf form-field retrieval can cause resource exhaustion
Summary
CVE-2026-113789: Crafted PDF documents can cause excessive memory consumption or prolonged processing when an application retrieves form fields. Affects pypdf versions < 6.21.0. Fixed in 6.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python package in the PyPI ecosystem for working with PDF documents. Applications use it to read and process PDF content, including retrieving form fields. This advisory concerns resource consumption during that form-field retrieval operation, so applications that process PDFs and access their fields may encounter the described behavior.
Vulnerability Detail
Retrieving form fields from a crafted PDF can cause excessive memory use or long runtimes, potentially exhausting application resources. The vulnerability is a denial-of-service issue associated with resource consumption and inefficient processing, classified as CWE-400 and CWE-407 in the advisory. Exploitation requires an application to retrieve the document’s form fields; the advisory does not describe impact on confidentiality or integrity.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.21.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.21.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Documented workaround: apply the changes from PR #4219 to pypdf if upgrading is not yet possible. The advisory does not provide a workaround command or code snippet.
Conclusion
Upgrade pypdf to 6.21.0, the minimum fixed version. If an upgrade is not yet possible, the advisory points to PR #4219 as a documented workaround. Applications that retrieve form fields from PDFs should account for this resource-consumption issue when processing documents. Vulert monitors the dependencies in Pipfile.lock and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for pypdf →
FAQ
pypdf versions introduced before 6.21.0 are affected; the advisory lists the affected range as starting at 0 and ending before 6.21.0.
A crafted PDF can cause pypdf to use large amounts of memory or run for a long time when retrieving form fields.
Upgrade pypdf to the minimum fixed version, 6.21.0, using the supplied pip command.
Apply the documented changes from pypdf PR #4219 as a workaround until you can upgrade.
Manually inspect Pipfile.lock for pypdf. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
