CVE-2026-115572 py-pdf CVE debrief

Who should care

Defenders responsible for systems and applications using pypdf should assess exposure and prioritize verification and remediation efforts. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also check relevant monitoring, detection, and logs for exposed

Why it matters

CVE-2026-115572 is a vulnerability in pypdf that can lead to long runtimes when processing specially crafted PDFs. Defenders should prioritize assessing exposure, verifying inventory, and applying patches or workarounds to prevent potential denial-of-service (DoS) attacks.

• Potential for denial-of-service (DoS) due to long runtimes
• Need for verification of pypdf versions and exposure
• Prioritization of patching or applying workarounds
• Potential impact on system performance and availability

Technical summary

The vulnerability in pypdf allows an attacker to craft a PDF that leads to long runtimes by referencing the same non-existent indirect object multiple times. This issue has been fixed in pypdf version 6.21.2. The vulnerability can cause potential denial-of-service (DoS) attacks due to long runtimes. Defenders should prioritize assessing exposure and verifying inventory for pypdf versions prior to 6.21.2. The changes from PR #4240 can be applied as a temporary workaround. The vulnerability affects systems and applications using pypdf, and defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Defenders should prioritize assessing exposure and verifying inventory for pypdf versions prior to 6.21.2, and consider applying the changes from PR #4240 as a temporary workaround.

Recommended defensive actions

• Assess exposure and verify inventory for pypdf versions prior to 6.21.2
• Consider applying the changes from PR #4240 as a temporary workaround
• Prioritize upgrading to pypdf version 6.21.2 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides limited information about the vulnerability, primarily focusing on the impact of long runtimes and the availability of a patch in pypdf version 6.21.2. However, details about potential exploitation, victims, or business impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.