CVE-2026-40260
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.42%
- CWE
- CWE-776
- Published
- 2026-04-16
- Last modified
- 2026-04-17
Affected products
- py-pdf pypdf
Weakness type
Related vulnerabilities
- CVE-2026-58234 — Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
- CVE-2026-16180 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-78681 — NLTK before 3.10.3 Entity Expansion DoS via ElementTree
- CVE-2026-73569 — fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
- CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
- CVE-2026-14865 — XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- CVE-2026-14979 — IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
- CVE-2026-45304 — Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")