{"id":"CVE-2026-115580","aliases":["GHSA-gmh7-3g9r-mjh5"],"url":"https://o3.security/vulnerability/CVE-2026-115580","summary":"pypdf: Possible long runtimes for large xref table header limits","details":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).","published":"2026-10-23T19:29:49.845Z","modified":"2026-10-24T10:52:04.427782745Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"pypdf","fixedVersion":"6.21.2"}],"fix":{"url":"https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2","label":"py-pdf/pypdf@a3061e3"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115580.json"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2"},{"type":"FIX","url":"https://github.com/py-pdf/pypdf/pull/4239"},{"type":"WEB","url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.2"},{"type":"ADVISORY","url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115580"},{"type":"PACKAGE","url":"https://github.com/py-pdf/pypdf"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:52:04.427782745Z"}}