CVE-2026-113791 py-pdf CVE debrief

Who should care

Defenders responsible for systems using pypdf should assess exposure and prioritize upgrading to version 6.21.0 or later. If an upgrade is not possible, consider applying the changes from PR #4218. The vulnerability can lead to large memory usage issues when parsing content streams with many small operations. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues when parsing content streams.

• Potential large memory usage issues when parsing content streams
• Need to upgrade to pypdf version 6.21.0 or later to prevent issues

Technical summary

The vulnerability in pypdf allows an attacker to craft a PDF that leads to large memory usage when parsing content streams with many small operations. This issue has been fixed in pypdf version 6.21.0. Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues. The vulnerability can be mitigated by applying the changes from PR #4218 if an upgrade is not possible. The CVE record was published on 2026-10-22T16:49:22.000Z and has not been modified since then. The affected product deployments should be reviewed to assess exposure.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.21.0 or later to prevent potential large memory usage issues.

Recommended defensive actions

• Upgrade to pypdf version 6.21.0 or later
• Apply changes from PR #4218 if upgrade is not possible
• Monitor for potential large memory usage issues when parsing content streams
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows an attacker to craft a PDF that leads to large memory usage when parsing content streams with many small operations. This issue has been fixed in pypdf version 6.21.0. The CVE record was published on 2026-10-22T16:49:22.000Z and has not been modified since then. Defenders should verify the affected scope and severity based on the official advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.