Dashboard / CVE-2026-113790

CVE-2026-113790

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-10-21 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: Present
VC: None
VI: None
VA: High

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
py-pdf pypdf < 6.21.0

References & Advisories (4)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.39%
Raw Score 0.003920
Percentile 33.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00392
2026-10-28
0.00392

Intelligence Sources

mitre ref →
nvd ref →

External Links