CVE-2026-113795
mediumpypdf is a free and open-source pure-python PDF library.
Vendor / product: Py-pdf — pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-21 16:17
Modified: 2026-11-02 16:13
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-11-03 07:34 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
py-pdf / pypdf <6.20.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/4173
References
- https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185 security-advisories@github.com
- https://github.com/py-pdf/pypdf/pull/4173 security-advisories@github.com
- https://github.com/py-pdf/pypdf/releases/tag/6.20.0 security-advisories@github.com
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:34 UTC · record ↗