pypdf has possible large memory usage for exceptions in strict mode

HOCH 7.1CVE-2026-119207 · GHSA-4vqv-7265-gm2w · Published 29/10/2026 · updated 30/10/2026

Kurz gesagt

CVE-2026-119207 ist eine Schwachstelle (HOCH (CVSS 7.1)) in pypdf.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.30%, höher als bei 23.2% aller Schwachstellen.
Abhilfe: auf 6.21.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.3`	`6.21.3`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4265.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.