要点
- CVE-2026-119209 是影响 pypdf, pypdf (py-pdf) 的中危 (CVSS 5.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.27%，高于 19.0% 的漏洞。
- 修复：升级到 6.21.3 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| pypdf PyPI | < 6.21.3
| 6.21.3
|
| pypdf | < 6.21.3
| 6.21.3
|
Description
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4269.
NVD description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free