CVE-2026-113790 py-pdf CVE debrief

Who should care

Defenders responsible for systems using pypdf should assess exposure and prioritize upgrading to version 6.21.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage pypdf deployments. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues when parsing arrays and dictionaries.

• Potential large memory usage issues when parsing arrays and dictionaries
• Need to upgrade to pypdf version 6.21.0 or later to prevent issues

Technical summary

The vulnerability allows an attacker to craft a PDF that leads to large memory usage by parsing arrays and/or dictionaries with lots of elements. This issue has been fixed in pypdf version 6.21.0. The vulnerability requires parsing arrays and/or dictionaries with lots of elements, which can lead to potential large memory usage issues. Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues when parsing arrays and dictionaries. Affected product deployments should be reviewed for exposure.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues.

Recommended defensive actions

• Upgrade to pypdf version 6.21.0 or later
• Apply changes from PR #4218 if upgrade is not possible
• Monitor for potential large memory usage issues when parsing arrays and dictionaries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows an attacker to craft a PDF that leads to large memory usage by parsing arrays and/or dictionaries with lots of elements. This issue has been fixed in pypdf version 6.21.0. Evidence is based on source-provided details and limited to public information. Defenders should verify affected scope and prioritize upgrading to version 6.21.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.