CVE-2026-113789: Algorithmic Complexity and Resource Exhaustion in pypdf Interactive Form Parsing

Vulnerability ID: CVE-2026-113789
CVSS Score: 6.0
Published: 2026-10-22

An uncontrolled resource consumption and inefficient algorithmic complexity vulnerability in pypdf prior to version 6.21.0 allows remote attackers to trigger application-level denial-of-service (DoS) via crafted PDF form field hierarchies.

TL;DR

pypdf prior to version 6.21.0 suffers from quadratic O(N^2) complexity in form field cycle detection and lacks traversal depth limits, enabling denial-of-service via malformed PDFs.

Technical Details

• CWE ID: CWE-400 / CWE-407
• Attack Vector: Network (Unauthenticated PDF Submission)
• CVSS v4.0 Score: 6.0 (Medium)
• EPSS Score: 0.00317 (23.44th percentile)
• Impact: Denial of Service (CPU & Memory Exhaustion)
• Exploit Status: No public weaponized exploit detected
• CISA KEV Status: Not listed

Affected Systems

• pypdf prior to 6.21.0
• Python applications calling get_fields() on untrusted PDF files
• Automated PDF document processing pipelines

Mitigation Strategies

• Upgrade pypdf dependency to version 6.21.0 or higher.
• Configure custom lower limits for form_fields_maximum_entries and form_fields_maximum_depth using apply_configuration.
• Implement exception handling for pypdf.errors.LimitReachedError in document ingestion pipelines.
• Enforce process execution timeouts and cgroup memory limits for background worker processes parsing user files.

Remediation Steps:

1. Update project requirements file (e.g., requirements.txt or pyproject.toml) to specify pypdf>=6.21.0.
2. Run pip install --upgrade pypdf.
3. Audit application code for calls to get_fields() or field manipulation methods.
4. Add try-except blocks catching LimitReachedError around reader.get_fields() calls.

References

• GitHub Security Advisory GHSA-6vvc-x485-93v7
• Fix Commit 5ef728f0e16d225c853e89f861ba0a67402fe3f2
• NVD Vulnerability Details CVE-2026-113789

Read the full report for CVE-2026-113789 on our website for more details including interactive diagrams and full exploit analysis.