CVE-2026-115585 pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115585?
CVE-2026-115585 is a high-severity vulnerability in py-pdf pypdf, published on 23 Oct 2026.
Official description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.
Which versions are affected by CVE-2026-115585?
2 open source packages ship an affected version, including pypdf.
| Package | Affected | Fixed in |
|---|---|---|
pypdf PyPI | All versions | 6.21.2 |
pypdf PyPI | All versions | 6.21.2 |
How do I fix CVE-2026-115585?
Upgrade pypdf to 6.21.2 or later.
Is CVE-2026-115585 being exploited?
There is no known exploitation of CVE-2026-115585 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115585, ECHO-acbe-2aad-5f05, GHSA-jr96-gvgh-j3r4, ROOT-APP-PYPI-CVE-2026-115585, UBUNTU-CVE-2026-115585.