CVE-2026-115572: 
Python vulnerability analysis and mitigation

CVE-2026-115572 is a Denial of Service vulnerability in pypdf, a free and open-source pure-Python PDF library. An attacker can craft a malicious PDF that repeatedly references the same nonexistent indirect object, causing the parser to trigger repeated full-file recovery loads and excessively long runtimes when relevant file parts (such as pages) are accessed. All versions of pypdf prior to 6.21.2 are affected. The vulnerability was published on October 23, 2026, with a fix released on October 21, 2026 in version 6.21.2. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). When pypdf's get_object() method encounters a reference to a nonexistent indirect object, it falls back to a full-file scan for recovery. Because the library did not cache the result of failed lookups, each subsequent reference to the same missing object triggered another complete file scan, leading to quadratic or worse time complexity. Additionally, the cross-reference table recovery buffer was re-read from the stream on every failed lookup rather than being cached. The fix in PR #4240 introduced caching of resolved (including failed) object lookups and refactored buffer reading into a shared get_stream_data() utility to ensure the recovery buffer is only read once (GitHub PR #4240, Commit 68a0e50). Exploitation requires user interaction — a victim application or user must open the crafted PDF (GitHub Advisory).

Successful exploitation causes the pypdf parser to consume excessive CPU and time resources, effectively hanging or severely degrading the performance of any application that processes the crafted PDF. The impact is limited to availability — there is no confidentiality or integrity impact. Applications that automatically process user-supplied PDFs (e.g., document management systems, web upload handlers) are at greatest risk, as a single malicious file could render the service unresponsive (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must open or process the crafted PDF), which limits the attack surface compared to fully remote, unauthenticated vulnerabilities (GitHub Advisory, Feedly).

1. Craft a malicious PDF: Create a PDF document that contains multiple references (e.g., within page objects or other structures) to the same indirect object ID that does not exist in the file's cross-reference table.
2. Distribute the PDF: Deliver the crafted PDF to a target that uses pypdf for processing — for example, by uploading it to a web application, emailing it to an automated document processor, or sharing it with a user who will open it with a pypdf-based tool.
3. Trigger parsing: When the application or user opens the PDF and accesses its pages or other content, pypdf's get_object() method is called for each reference to the nonexistent object.
4. Exhaust resources: Each call to get_object() for the missing object triggers a full-file scan (recovery load) because failed lookups were not cached in vulnerable versions. With many repeated references, this causes the process to consume excessive CPU time and potentially hang indefinitely, resulting in a Denial of Service (GitHub Advisory, GitHub PR #4240).

• Process Behavior: Python processes consuming abnormally high CPU for extended periods while processing PDF files; processes that appear to hang or become unresponsive during PDF parsing operations.
• Logs: Application logs showing timeouts or unresponsiveness correlated with PDF file processing events; error logs from pypdf indicating repeated recovery attempts or PdfReadError exceptions.
• File System: Presence of suspicious PDF files with unusual internal structure — specifically, page or object dictionaries containing many references to the same high-numbered or otherwise nonexistent indirect object IDs.
• Network: For web applications, HTTP requests that upload PDF files followed by prolonged response times or server-side timeouts on endpoints that process PDFs.

Upgrade pypdf to version 6.21.2 or later, which caches failed object lookups and reads the recovery buffer only once, eliminating the repeated full-file scan behavior (pypdf Release 6.21.2). For deployments that cannot immediately upgrade, the changes from PR #4240 can be applied manually as a workaround (GitHub PR #4240). Additionally, consider implementing processing timeouts for PDF parsing operations, validating or sandboxing PDF inputs from untrusted sources, and restricting PDF processing to trusted sources where feasible.

The vulnerability was reported by researcher manop55555 and fixed by pypdf maintainer stefan6419846 (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it medium severity (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.