CVE-2026-115585: 
Python vulnerability analysis and mitigation

CVE-2026-115585 is a Denial of Service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by an incomplete remediation of a prior issue (GHSA-55h5-xmcq-c37v). Prior to version 6.21.2, crafted PDF files containing repeated malformed cross-reference entries could trigger a complete PDF stream reload during each recovery attempt, even when a recovery cache was present, resulting in excessive processing time and resource exhaustion. All pypdf versions before 6.21.2 are affected. The vulnerability was published on October 23, 2026, with a fix released on October 21, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-407 (Inefficient Algorithmic Complexity), and CWE-770 (Allocation of Resources Without Limits or Throttling). The prior fix for GHSA-55h5-xmcq-c37v introduced a recovery cache intended to prevent repeated full-stream reloads, but the cache check was bypassed under certain conditions — specifically, the code checked cache_get_indirect_object() but did not properly gate on whether the key was already in resolved_objects, causing the full PDF stream to be re-read on every recovery attempt for the same malformed cross-reference entry. The fix in PR #4240 addresses two related issues: avoiding repeated full file scans for the same invalid object, and reading the cross-reference table buffer only once during recovery (GitHub Advisory, Fix Commit). Exploitation requires a user or automated system to open a specially crafted PDF file, making user interaction a prerequisite.

Successful exploitation causes the pypdf library to consume excessive CPU and memory resources, rendering the application processing the PDF unresponsive or causing it to crash. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications that automatically process user-supplied or externally sourced PDF files (e.g., document management systems, web services accepting PDF uploads) are at elevated risk, as an unauthenticated attacker could trigger the condition by submitting a crafted PDF (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires convincing a user or automated pipeline to process a malicious PDF, which limits the attack surface compared to fully remote, unauthenticated vectors.

1. Craft a malicious PDF: Create a PDF file containing cross-reference streams with a large number of repeated malformed cross-reference entries designed to trigger the recovery path in pypdf's parser on each object lookup.
2. Deliver the PDF: Submit the crafted PDF to a target application that uses pypdf for processing — for example, by uploading it to a document management portal, emailing it to a user who will open it with a pypdf-based tool, or placing it in a directory monitored by an automated pipeline.
3. Trigger parsing: When the application or user opens the PDF using a vulnerable version of pypdf (< 6.21.2), the library attempts to recover from the malformed cross-reference entries.
4. Exhaust resources: Due to the incomplete cache check, pypdf reloads the entire PDF stream on each recovery attempt for each malformed entry, causing CPU and memory consumption to grow proportionally with the number of malformed entries, eventually causing the process to hang or crash (GitHub Advisory, Fix Commit).

• Process: Python processes consuming abnormally high CPU or memory while processing PDF files; processes that hang or become unresponsive during PDF parsing operations.
• Logs: Application logs showing repeated or long-running PDF read/parse operations for the same file; timeout errors or out-of-memory exceptions originating from pypdf's _reader.py or cross-reference parsing routines.
• File System: Presence of unexpected or externally sourced PDF files in upload directories or processing queues, particularly files with unusually large or repetitive cross-reference table sections.

The primary remediation is to upgrade pypdf to version 6.21.2 or later, which contains the fix introduced in PR #4240 (pypdf Release). For environments that cannot upgrade immediately, the changes from PR #4240 can be applied manually as a workaround (GitHub PR #4240). Additionally, implementing resource limits (CPU time, memory) and processing timeouts for PDF operations, as well as input validation to reject PDFs with suspicious cross-reference structures before passing them to pypdf, can reduce exposure.

The vulnerability was reported with AI assistance and credited to researchers kyrux29 and loegaire, with analysis by maintainer stefan6419846 (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it medium severity (Red Hat Bugzilla). Automated dependency audit bots in downstream projects (e.g., on GitHub) flagged the vulnerability shortly after disclosure, prompting dependency updates in several open-source projects (GitHub PR #4240). No significant broader media coverage or notable social media discussion beyond standard CVE notification channels was observed.