CVE-2026-113789 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using pypdf should assess exposure and prioritize mitigation to prevent potential memory usage and runtime issues. This includes roles responsible for system and application security, particularly those using pypdf, as well as operators and platform administrators who need to ensure the security of their environments. Vulnerability management and security teams should also be aware of this issue and take a

Why it matters

Defenders should care about CVE-2026-113789 because it involves a vulnerability in pypdf that can lead to large memory usage and long runtimes when retrieving form fields from crafted PDFs. This requires attention from roles responsible for system and application security, particularly those using pypdf. The vulnerability has been patched in version 6.21.0, and defenders should prioritize upgrading or applying workarounds.

• Potential for large memory usage
• Potential for long runtimes in PDF processing
• Need for verification of affected versions and remediation
• Importance of monitoring PDF processing workflows

Technical summary

The vulnerability in pypdf allows an attacker to craft a PDF that leads to large memory usage and/or long runtimes when retrieving form fields. This issue has been fixed in pypdf version 6.21.0. Affected product deployments should be identified and assessed for exposure. Defenders should prioritize upgrading to pypdf==6.21.0 or applying workarounds from PR #4219 to mitigate potential memory usage and runtime issues. The vulnerability requires attention from roles responsible for system and application security, particularly those using pypdf.

Defensive priority

Defenders should prioritize upgrading to pypdf==6.21.0 or applying workarounds from PR #4219 to mitigate potential memory usage and runtime issues.

Recommended defensive actions

• Upgrade to pypdf==6.21.0
• Apply workarounds from PR #4219 if immediate upgrade is not feasible
• Review and monitor PDF processing workflows for potential memory usage and runtime issues
• Perform vulnerability assessment to identify affected product deployments
• Verify and implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

Evidence from the source corpus indicates that the vulnerability can lead to large memory usage and/or long runtimes when retrieving form fields from a crafted PDF. The issue is addressed in pypdf version 6.21.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.