pypdf has possible long runtimes/large memory usage for encrypted PDF files

HOCH 7.1CVE-2026-119208 · GHSA-62m5-6wh8-28x7 · Published 29/10/2026 · updated 30/10/2026

Kurz gesagt

CVE-2026-119208 ist eine Schwachstelle (HOCH (CVSS 7.1)) in pypdf.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.30%, höher als bei 23.2% aller Schwachstellen.
Abhilfe: auf 6.21.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.3`	`6.21.3`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4270.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.