Is there a patch available for CVE-2026-41313?

Yes, a patch is available for CVE-2026-41313. Update the affected software to the latest version immediately.

pypdf CVE-2026-41313

Q: What is the CVSS score of CVE-2026-41313?

CVE-2026-41313 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25114 MEDIUM

Excessive Iteration (CWE-834)

2026-04-22 GitHub_M

Information Disclosure Python Red Hat Suse

4.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 27, 2026 - 19:30 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:07 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

CVSS changed

Apr 22, 2026 - 22:22 NVD

4.8 (MEDIUM)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25114

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:04 nvd

MEDIUM 4.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

89 pypi packages depend on pypdf (19 direct, 70 indirect)

Ecosystem-wide dependent count for version 6.10.2.

DescriptionGitHub Advisory

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

AnalysisAI

Denial of service via algorithmic complexity in pypdf versions prior to 6.10.2 allows local attackers to cause long runtimes by crafting a PDF with an excessively large trailer /Size value when loaded in incremental mode. The vulnerability requires user interaction to load the malicious PDF and results in availability degradation rather than data compromise. Patch version 6.10.2 is available from the vendor.

Technical ContextAI

pypdf is a pure-Python PDF processing library that implements PDF parsing according to the ISO 32000 specification. The vulnerability exists in the incremental PDF update mechanism, which allows PDFs to be modified by appending new content rather than rewriting the entire file. The /Size entry in a PDF's trailer dictionary specifies the total number of indirect objects in the file. When pypdf processes a PDF in incremental mode with a crafted /Size value set to an artificially large number, the parser allocates or iterates over resources based on this value, causing algorithmic complexity (CWE-834: Excessive Iteration) that leads to prolonged processing times. This affects the cross-reference table parsing and object lookup mechanisms.

RemediationAI

Upgrade pypdf to version 6.10.2 or later immediately. The vendor has released patched version 6.10.2 available at https://github.com/py-pdf/pypdf/releases/tag/6.10.2. As a workaround, users unable to upgrade immediately may manually apply the patch from the GitHub pull request at https://github.com/py-pdf/pypdf/pull/3735 or the specific commit at https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a. For applications that process untrusted PDFs, implement input validation to reject PDFs with unreasonably large /Size values in the trailer dictionary (e.g., reject /Size values exceeding 1,000,000 objects) as a compensating control. This may reject some legitimately large PDFs but prevents algorithmic complexity attacks. Alternatively, implement timeout mechanisms on PDF parsing operations to limit processing time, though this may result in incomplete PDF processing.