Live › vulnerability › CVE-2026-119204
pypdf, a pure-Python PDF library, can use excessive memory when parsing a crafted PDF whose page tree contains many shared resources. An attacker who supplies such a PDF can make the process consume disproportionate memory, which can crash or stall the program that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Any application that uses pypdf to parse PDFs from untrusted sources, such as user uploads, email attachments or web fetches, is exposed to memory exhaustion. Applications that only process PDFs they generate or fully control can skip it.
No product ranges from the sources yet.
pip show pypdf or python -c "import pypdf; print(pypdf.__version__)"requirements.txt, pyproject.toml or poetry.lock for pypdf below 6.21.46.21.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-119204")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.