{"id":"CVE-2026-119207","kind":"vulnerability","aliases":["CVE-2026-119207"],"related":[],"title":"pypdf: crafted PDF dictionary exhausts memory in strict mode","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.","summary":"pypdf, a pure-Python PDF library, can consume excessive memory when strict mode parses a crafted invalid PDF dictionary. Nested parsing failures repeat exception text, so a small malformed file can produce very large error messages and exhaust memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pypdf","python"],"not_affected_if":["pypdf-6.21.3-or-later","strict-mode-off","trusted-input-only"],"how_to_check":"- `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"` to read the installed version\n- Check requirements files and lockfiles for pypdf pinned below `6.21.3`\n- Check whether the code calls pypdf with strict mode enabled (`strict=True`) on untrusted PDFs","fix":"- pypdf: move to `6.21.3` or later","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:38+00:00","updated_at":"2026-10-29T21:28:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:38Z","model":"claude-haiku-5-5","output":{"fix":"- pypdf: move to `6.21.3` or later","reach":"unknown","title":"pypdf: crafted PDF dictionary exhausts memory in strict mode","impact":"low","summary":"pypdf, a pure-Python PDF library, can consume excessive memory when strict mode parses a crafted invalid PDF dictionary. Nested parsing failures repeat exception text, so a small malformed file can produce very large error messages and exhaust memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Crafted PDF exhausts process memory, causing denial of service.","analyst_note":"","how_to_check":"- `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"` to read the installed version\n- Check requirements files and lockfiles for pypdf pinned below `6.21.3`\n- Check whether the code calls pypdf with strict mode enabled (`strict=True`) on untrusted PDFs","plain_action":"","needs_analyst":false,"not_affected_if":["pypdf-6.21.3-or-later","strict-mode-off","trusted-input-only"],"who_is_affected":"Applications that parse PDFs with pypdf, particularly with strict mode enabled, and that accept PDFs from users or other untrusted sources. Batch jobs and services that only process PDFs they generate themselves are less exposed. unknown whether default settings are affected beyond strict mode.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4133,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119207':12A,15A '-2026':11A,14A '6.21.3':74C,118C 'add':92C 'allow':100C 'amplifi':106C 'consum':27B,77C 'craft':2A,35B,85C 'cve':10A,13A 'dictionari':4A,38B,88C,104C 'error':54B,99C,110C 'except':43B,94C 'excess':28B,78C 'exhaust':5A,57B 'failur':41B,91C 'file':49B 'fix':115C 'free':62C 'invalid':36B,86C 'issu':113C 'larg':53B,109C 'librari':25B,71C 'load':83C 'malform':48B,103C 'memori':6A,29B,58B,79C 'messag':55B,111C 'mode':9A,32B,82C 'nest':39B,89C 'newli':97C 'open':65C 'open-sourc':64C 'packag':16B 'pars':33B,40B,90C 'pdf':3A,24B,37B,70C,87C 'prior':72C 'produc':51B 'pure':22B,68C 'pure-python':21B,67C 'pypdf':1A,17B,19B,59C,75C 'python':18B,23B,69C 'rais':98C 'repeat':42B,93C 'small':47B,102C 'sourc':66C 'strict':8A,31B,81C 'text':44B,95C 'version':117C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse PDFs with pypdf, particularly with strict mode enabled, and that accept PDFs from users or other untrusted sources. Batch jobs and services that only process PDFs they generate themselves are less exposed. unknown whether default settings are affected beyond strict mode.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119207","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}