PyPDF & fpdf2: Batch of 13 DoS Vulnerabilities Disclosed Together
Thirteen vulnerabilities in PyPDF and fpdf2 libraries disclosed, primarily causing denial-of-service through crafted PDF files.
Key findings
- Thirteen vulnerabilities disclosed across PyPDF and fpdf2 libraries between Oct 21-23, 2026.
- Multiple PyPDF CVEs cause DoS via excessive memory use or infinite loops from crafted PDFs.
- CVE-2026-115585, CVE-2026-115580, CVE-2026-115572 target malformed cross-reference entries in PyPDF.
- fpdf2 vulnerabilities CVE-2026-114610 and CVE-2026-114609 involve SVG processing and URL dereferencing.
- Patches are available, with specific fixes released across PyPDF versions 6.20.0, 6.20.1, 6.21.0, 6.21.1, and 6.21.2.
- fpdf2 versions prior to 2.8.8 are affected; update to 2.8.8 or later.
On October 23, 2026, a batch of thirteen vulnerabilities affecting the PyPDF and fpdf2 Python PDF manipulation libraries was disclosed. The vulnerabilities, disclosed between October 21 and October 23, 2026, primarily concern denial-of-service (DoS) conditions, including excessive memory consumption and infinite loops, triggered by specially crafted PDF files. These issues could lead to application instability and resource exhaustion.
Several vulnerabilities in PyPDF (CVE-2026-115585, CVE-2026-115580, CVE-2026-115572) relate to the handling of malformed cross-reference entries and repeated stream reloads, potentially causing complete PDF stream reloads and long runtimes. CVE-2026-115585 specifically addresses an incomplete remediation for repeated malformed cross-reference entries that could still trigger a full PDF stream reload. CVE-2026-115580 details how an attacker can craft a PDF with an excessive declared entry count in its cross-reference table, leading to long runtimes. CVE-2026-115572 describes a scenario where a PDF repeatedly references a nonexistent indirect object, causing repeated full-file recovery loads.
Other PyPDF vulnerabilities disclosed on October 21, 2026, focus on resource exhaustion and infinite loops. CVE-2026-113795 (High) involves large memory consumption when accessing a crafted PDF stream with numerous or complex filters. CVE-2026-113794 (Medium) describes an infinite loop caused by an incomplete PDF ending within a cross-reference table. CVE-2026-113793 and CVE-2026-113792 (both Medium) detail infinite loops triggered by crafted cyclic PDF trees or outline hierarchies when removing objects or finding outline items, respectively. Additionally, CVE-2026-113791 and CVE-2026-113790 (both Medium) highlight memory exhaustion issues during parsing due to a large number of small operations in content streams or numerous elements in arrays and dictionaries. CVE-2026-113789 (Medium) also leads to large memory usage or long runtimes when retrieving form fields from a crafted PDF. Finally, CVE-2026-113786 (Low) involves an unintended image parser being invoked by Pillow when loading images with the /DCTDecode filter in crafted PDFs.
The fpdf2 library is affected by two medium-severity vulnerabilities disclosed on October 22, 2026. CVE-2026-114610 describes how nested SVG <use> references in FPDF.image() can lead to excessive copying of graphics trees due to default deep-copy behavior. CVE-2026-114609 points out that the shared image loader in fpdf2 automatically dereferences attacker-controlled HTTP(S) URLs and local paths, which could be exploited.
The PyPDF library has seen multiple fixes. Versions prior to 6.21.2 address CVE-2026-115585, CVE-2026-115580, and CVE-2026-115572. CVE-2026-113795 and CVE-2026-113794 are fixed in version 6.20.0. CVE-2026-113793 and CVE-2026-113792 are resolved in version 6.20.1. CVE-2026-113791, CVE-2026-113790, and CVE-2026-113789 are fixed in version 6.21.0. CVE-2026-113786 is addressed in version 6.21.1. For fpdf2, versions prior to 2.8.8 address CVE-2026-114610 and CVE-2026-114609. Users of these libraries are advised to update to the patched versions to mitigate these vulnerabilities.
This batch of vulnerabilities underscores the importance of robust PDF parsing and handling in Python applications. Developers relying on PyPDF and fpdf2 should prioritize updating their dependencies to the latest secure versions to prevent potential denial-of-service attacks and resource exhaustion caused by maliciously crafted PDF files. The varied nature of the vulnerabilities, from cross-reference table manipulation to image parsing and SVG handling, highlights the complexity of PDF processing and the need for continuous security vigilance.