CVE-2026-113795: pypdf: Possible large memory usage for streams with multiple filters

October 21, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.

References

github.com/advisories/GHSA-7mh2-4gg2-979f
github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185
github.com/py-pdf/pypdf/pull/4173
github.com/py-pdf/pypdf/releases/tag/6.20.0
github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f
nvd.nist.gov/vuln/detail/CVE-2026-113795

Code Behaviors & Features

Detect and mitigate CVE-2026-113795 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →