pypdf has possible large memory usage for exceptions in strict mode

HIGHCVE-2026-119207 · GHSA-4vqv-7265-gm2w · Published 30/10/2026 · updated 30/10/2026

In short

CVE-2026-119207 is a HIGH vulnerability affecting pypdf.
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 23.2% of all vulnerabilities.
Fix: update to 6.21.3 or later.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.3`	`6.21.3`

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.

This has been fixed in pypdf==6.21.3.

If you cannot upgrade yet, consider applying the changes from PR #4265.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.