Live › vulnerability › CVE-2026-119207
pypdf, a pure-Python PDF library, can consume excessive memory when strict mode parses a crafted invalid PDF dictionary. Nested parsing failures repeat exception text, so a small malformed file can produce very large error messages and exhaust memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications that parse PDFs with pypdf, particularly with strict mode enabled, and that accept PDFs from users or other untrusted sources. Batch jobs and services that only process PDFs they generate themselves are less exposed. unknown whether default settings are affected beyond strict mode.
No product ranges from the sources yet.
pip show pypdf or python -c "import pypdf; print(pypdf.__version__)" to read the installed version6.21.3strict=True) on untrusted PDFs6.21.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119207")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.