# CVE-2026-115572: pypdf repeated PDF object reference denial of service

Source: https://junglewise.ai/threats/cve-2026-115572-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115572 · Severity: high · CVSS 4 · Published 2026-10-23

pypdf is a Python library for processing PDF files. An attacker can craft a malicious PDF that causes the library to repeatedly perform resource-intensive recovery operations when accessing file contents, leading to excessive CPU usage and processing delays or application hangs.

Technologies: [Py-Pdf Pypdf](https://junglewise.ai/threats/technologies/py-pdf-pypdf), [pypdf (PyPI)](https://junglewise.ai/threats/technologies/pypdf). Vendors: [Py-Pdf](https://junglewise.ai/threats/vendors/py-pdf), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-115572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115572 being exploited in the wild.

**How severe is CVE-2026-115572?** High severity, with a CVSS score of 4, published 23 October 2026.

**Which products and versions are affected?** Py-Pdf Pypdf prior to 6.21.2; pypdf (PyPI) < 6.21.2, ECOSYSTEM:introduced=0,fixed=6.21.2.

**Is there a fix for CVE-2026-115572?** Yes. pypdf (PyPI): upgrade to 6.21.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115572 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115572?** Check whether you run Py-Pdf Pypdf or pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pypdf (PyPI): upgrade to 6.21.2 or later

  ```sh
  pip install "pypdf>=6.21.2"
  ```


## Technical details

The vulnerability occurs when a PDF contains repeated references to the same nonexistent indirect object. This causes pypdf to trigger repeated full-file recovery loads during object retrieval, resulting in denial of service through resource exhaustion. The issue affects versions prior to 6.21.2 and is fixed by caching invalid object lookups and reading the cross-reference table only once during recovery.

## Affected products

- py-pdf pypdf prior to 6.21.2

## Identifiers

- CVE-2026-115572
- GHSA-6c7f-9265-g8fw

## Timeline

- 2026-10-23: disclosed
- 2026-10-21: patched

## References

- [https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b](https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b)
- [https://github.com/py-pdf/pypdf/pull/4240](https://github.com/py-pdf/pypdf/pull/4240)

## Related threats

- [pypdf memory exhaustion in cross-reference stream parsing](https://junglewise.ai/threats/cve-2026-119209-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf denial of service via forged encrypted PDF page count](https://junglewise.ai/threats/cve-2026-119208-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf excessive memory consumption in strict mode PDF parsing](https://junglewise.ai/threats/cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf denial of service via crafted page labels](https://junglewise.ai/threats/cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf infinite loop in DictionaryObject cloning](https://junglewise.ai/threats/cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)