CVE-2026-40260

Description

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.

PUBLISHED Reserved 2026-04-10 | Published 2026-04-16 | Updated 2026-04-17 | Assigner GitHub_M

Problem types

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Product status

References

github.com/.../pypdf/security/advisories/GHSA-3crg-w4f6-42mx

github.com/py-pdf/pypdf/pull/3724

github.com/...ommit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8

github.com/py-pdf/pypdf/releases/tag/6.10.0

cve.org (CVE-2026-40260)

nvd.nist.gov (CVE-2026-40260)

Download JSON