CVE-2026-115580

pypdf prior to 6.21.3 can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply parsed entries, while negative /Index counts bypass the existing per-stream clamp.

pypdf prior to 6.21.3 can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree.

pypdf prior to 6.21.3 can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages.

pypdf prior to 6.21.3 can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning.

pypdf prior to 6.21.4 can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check.

pypdf prior to 6.21.4 can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, causing disproportionate allocations.

pypdf before version 6.21.4 can enter an infinite loop when opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating, blocking the processing thread.

In pypdf prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

pypdf before version 6.21.2 is vulnerable to an attack where a crafted PDF repeatedly references the same nonexistent indirect object. This triggers repeated full-file recovery loads and long runtimes when accessing parts such as pages. The issue is fixed in version 6.21.2.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.