{"id":"CVE-2026-119204","kind":"vulnerability","aliases":["CVE-2026-119204"],"related":[],"title":"pypdf: crafted PDF page tree can exhaust memory during parsing","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.","summary":"pypdf, a pure-Python PDF library, can use excessive memory when parsing a crafted PDF whose page tree contains many shared resources. An attacker who supplies such a PDF can make the process consume disproportionate memory, which can crash or stall the program that parses it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","package","pypdf","python"],"not_affected_if":["pypdf-not-used","trusted-input-only"],"how_to_check":"- Check the installed pypdf version with `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"`\n- Check pinned versions in `requirements.txt`, `pyproject.toml` or `poetry.lock` for pypdf below `6.21.4`","fix":"- pypdf: `6.21.4`","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:41+00:00","updated_at":"2026-10-29T21:28:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:41Z","model":"claude-haiku-5-5","output":{"fix":"- pypdf: `6.21.4`","reach":"unknown","title":"pypdf: crafted PDF page tree can exhaust memory during parsing","impact":"low","summary":"pypdf, a pure-Python PDF library, can use excessive memory when parsing a crafted PDF whose page tree contains many shared resources. An attacker who supplies such a PDF can make the process consume disproportionate memory, which can crash or stall the program that parses it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf","document-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Parsing process exhausts memory and crashes or stalls","analyst_note":"","how_to_check":"- Check the installed pypdf version with `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"`\n- Check pinned versions in `requirements.txt`, `pyproject.toml` or `poetry.lock` for pypdf below `6.21.4`","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","pypdf-not-used"],"who_is_affected":"Any application that uses pypdf to parse PDFs from untrusted sources, such as user uploads, email attachments or web fetches, is exposed to memory exhaustion. Applications that only process PDFs they generate or fully control can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4144,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119204':13A,16A '-2026':12A,15A '6.21.4':84C,134C 'alloc':127C 'allow':119C 'attack':47B 'budget':118C 'caus':125C 'consum':57B,87C 'contain':42B,97C 'copi':105C 'craft':2A,37B,93C,121C 'crash':62B 'cve':11A,14A 'dictionari':107C 'disproportion':58B,126C 'document':18B,115C 'document-process':17B 'document-wid':114C 'entri':111C,117C 'excess':32B,88C 'exhaust':7A 'fix':131C 'flatten':104C 'free':72C 'inherit':109C 'issu':129C 'librari':29B,81C 'make':54B 'mani':43B,98C 'memori':8A,33B,59B,89C 'open':75C 'open-sourc':74C 'packag':20B 'page':4A,40B,95C,102C,106C 'page-tre':101C 'pars':10A,35B,68B,91C 'pdf':3A,28B,38B,52B,80C,94C 'prior':82C 'process':19B,56B 'program':66B 'pure':26B,78C 'pure-python':25B,77C 'pypdf':1A,21B,23B,69C,85C 'python':22B,27B,79C 'resourc':45B,100C,110C,122C 'share':44B,99C 'sourc':76C 'stall':64B 'structur':123C 'suppli':49B 'tree':5A,41B,96C,103C 'use':31B 'version':133C 'whose':39B 'wide':116C 'without':112C","nicknames":[],"mitigations":[],"who_affected":"Any application that uses pypdf to parse PDFs from untrusted sources, such as user uploads, email attachments or web fetches, is exposed to memory exhaustion. Applications that only process PDFs they generate or fully control can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119204","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}