CVE-2026-115580: 
Python vulnerability analysis and mitigation

CVE-2026-115580 is a Denial of Service vulnerability in pypdf, a free and open-source pure-Python PDF library. An attacker can craft a malicious PDF file with a standard cross-reference (xref) table whose declared entry count exceeds what the file can actually contain, causing excessive processing loops and long runtimes when the file is opened. All versions of pypdf prior to 6.21.2 are affected. The vulnerability was disclosed on October 23, 2026, with a fix released on October 21, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is insufficient validation of the declared entry count in a PDF's standard cross-reference (xref) table header before iterating over entries, classified as CWE-606 (Unchecked Input for Loop Condition) and CWE-834 (Excessive Iteration). When pypdf parses a crafted PDF, it reads the declared size from the xref table header without checking whether that size is plausible given the actual file size, leading to an unbounded processing loop. The fix introduced in PR #4239 adds a _read_standard_xref_table__handle_size method that computes a size_limit based on the actual stream size (dividing by 20 bytes per valid xref entry) and raises a LimitReachedError if the declared size exceeds this limit (GitHub PR #4239, GitHub Commit). The vulnerability was reported by researcher ducanhmit and analyzed by stefan6419846 (GitHub Advisory).

Successful exploitation causes the affected application to become unresponsive or experience severely degraded performance due to excessive CPU and processing resource consumption. The impact is limited to availability — there is no confidentiality or integrity impact, as no data is exposed or modified. Applications that automatically process user-supplied or externally sourced PDF files (e.g., document management systems, web services accepting PDF uploads) are at greatest risk, as a single malicious file can render the PDF processing component unavailable (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim or automated process must open the crafted PDF file — but no authentication or special privileges are required of the attacker (Red Hat Bugzilla).

1. Craft a malicious PDF: Create a PDF file with a standard cross-reference table header that declares an entry count far exceeding what the file's actual size could contain (e.g., declare millions of entries in a small file). The xref table header format is <first_object_number> <entry_count>, so setting entry_count to an arbitrarily large integer is sufficient.
2. Deliver the file: Provide the crafted PDF to a target system or user that processes PDFs using a vulnerable version of pypdf (< 6.21.2). This could be via email attachment, file upload to a web service, or placing the file in a directory monitored by an automated pipeline.
3. Trigger processing: Cause the target application to open the PDF using pypdf (e.g., by submitting it to a document conversion service, triggering an automated scan, or convincing a user to open it in an application backed by pypdf).
4. Achieve denial of service: pypdf's _read_standard_xref_table method reads the inflated entry count and begins iterating, consuming excessive CPU and memory resources, causing the application to hang or become unresponsive for an extended period (GitHub Advisory, GitHub PR #4239).

• File System: Presence of PDF files with anomalously small file sizes but unusually large declared xref table entry counts; unexpected PDF files in upload directories or processing queues.
• Process: Python processes consuming abnormally high CPU for extended periods while processing PDF files; hung or unresponsive worker processes associated with PDF handling services.
• Logs: Application logs showing pypdf raising LimitReachedError with messages such as Declared size <N> exceeds allowed limit of <M>! (on patched versions detecting the attack); timeouts or worker process crashes in PDF processing pipelines.
• Network: Repeated submission of the same or similarly sized PDF files to upload endpoints, particularly from the same source IP, which may indicate automated delivery of malicious files.

Upgrade pypdf to version 6.21.2 or later, which limits the xref table entry count based on the actual file size (pypdf Release 6.21.2). For environments that cannot upgrade immediately, the changes from PR #4239 can be applied manually as a workaround (GitHub PR #4239). Additionally, consider implementing file size limits and processing timeouts for PDF handling, validating PDF cross-reference table entries before processing, and sandboxing PDF processing operations to limit the blast radius of resource exhaustion attacks.

The vulnerability was assigned moderate severity by the pypdf maintainer stefan6419846, who also authored the fix (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it medium priority and severity (Red Hat Bugzilla). Automated CVE notification accounts on Mastodon (infosec.exchange) and Bluesky posted about the disclosure shortly after publication, reflecting routine community awareness activity with no notable controversy or elevated concern.