CVE-2026-115572 pypdf: Possible long runtimes for repeated references to the same missing object
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115572?
CVE-2026-115572 is a high-severity vulnerability in py-pdf pypdf, published on 23 Oct 2026.
Official description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.
Weakness: CWE-400
Which versions are affected by CVE-2026-115572?
2 open source packages ship an affected version, including pypdf.
| Package | Affected | Fixed in |
|---|---|---|
pypdf PyPI | All versions | 6.21.2 |
pypdf PyPI | All versions | 6.21.2 |
How do I fix CVE-2026-115572?
Upgrade pypdf to 6.21.2 or later.
Is CVE-2026-115572 being exploited?
There is no known exploitation of CVE-2026-115572 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115572, ECHO-3dbe-66b2-4bc7, GHSA-6c7f-9265-g8fw, ROOT-APP-PYPI-CVE-2026-115572, UBUNTU-CVE-2026-115572.