PatchSiren cyber security CVE debrief

CVE-2026-115585 py-pdf CVE debrief

CVE-2026-115585: pypdf Possible long runtimes for repeated malformed cross-reference entries (Follow-up). This vulnerability affects pypdf and can cause long runtimes when processing crafted PDFs with repeated malformed cross-reference entries. The issue has been fixed in pypdf version 6.21.2. Defenders should assess their exposure and prioritize upgrading or applying the changes from PR #4240. The vulnerability has a potential impact on PDF processing workflows, particularly those using pypdf. Upgrading to version 6.21.2 or applying the changes from PR #4240 can prevent this issue. The CVE record and source item provide information on the vulnerability, its impact, and the fixed 6

Vendor: py-pdf
Product: pypdf
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-23
Original CVE updated: 2026-10-23
Advisory published: 2026-10-23
Advisory updated: 2026-10-23

Who should care

Defenders responsible for PDF processing workflows, particularly those using pypdf, should assess their exposure and prioritize upgrading or applying the changes from PR #4240. The vulnerability has a potential impact on PDF processing workflows, particularly those using pypdf. Upgrading to version 6.21.2 or applying the changes from PR #4240 can prevent this issue. Defenders should review and monitor PDF processing workflows for potential long runtimes.

Why it matters

Defenders should care about CVE-2026-115585 because it can cause long runtimes in PDF processing workflows, particularly those using pypdf. Upgrading to version 6.21.2 or applying the changes from PR #4240 can prevent this issue.

Potential long runtimes in PDF processing workflows
Need to verify and upgrade to pypdf version 6.21.2 or apply PR #4240 changes

Technical summary

The vulnerability in pypdf can cause long runtimes when processing crafted PDFs with repeated malformed cross-reference entries. This has been fixed in pypdf version 6.21.2. The issue affects pypdf and can impact PDF processing workflows, particularly those using pypdf. Upgrading to version 6.21.2 or applying the changes from PR #4240 can prevent this issue. The vulnerability has a potential impact on PDF processing workflows, particularly those using pypdf. Defenders should assess their exposure and prioritize upgrading or applying the changes from PR #4240.

Defensive priority

Defenders should prioritize upgrading to pypdf version 6.21.2 or applying the changes from PR #4240 to prevent potential long runtimes caused by crafted PDFs.

Recommended defensive actions

Upgrade to pypdf version 6.21.2 or later
Apply the changes from PR #4240 if upgrading is not possible
Review and monitor PDF processing workflows for potential long runtimes
Verify PDF processing workflows for potential long runtimes caused by crafted PDFs
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide information on the vulnerability, its impact, and the fixed version of pypdf. However, the CVSS score and severity are not provided. The vulnerability affects pypdf and can cause long runtimes when processing crafted PDFs with repeated malformed cross-reference entries. The issue has been fixed in pypdf version 6.21.2. Defenders should assess their exposure and prioritize upgrading or applying the changes from PR #4240. The vulnerability has a potential impact on PDF processing workflows, partic

Sources and references

Verified primary and authoritative sources

CVE-2026-115585 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-115585

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-115585 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115585

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
Unverified legacy reference

URL: https://storage.googleapis.com/osv-vulnerabilities/PyPI/GHSA-jr96-gvgh-j3r4.json

osv_dev
Source reference
Unverified legacy reference

URL: https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/py-pdf/pypdf/pull/4240

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/py-pdf/pypdf

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/py-pdf/pypdf/releases/tag/6.21.2

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.