CVE-2026-115585

— UNSCOREDpublic exploit available

Published 2026-10-23 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

Weaknesses

CWE-400, CWE-407

Public exploit & PoC references

https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
https://github.com/py-pdf/pypdf/pull/4240
https://github.com/py-pdf/pypdf/releases/tag/6.21.2
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4

All references

https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
https://github.com/py-pdf/pypdf/pull/4240
https://github.com/py-pdf/pypdf/releases/tag/6.21.2
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-102277PoC
HIGHCVE-2026-102994PoC
HIGHCVE-2026-102997PoC
HIGHCVE-2026-102999PoC
MEDIUMCVE-2026-104844PoC
MEDIUMCVE-2026-107287PoC
HIGHCVE-2026-111758PoC
HIGHCVE-2026-111759PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.