Live › vulnerability › CVE-2026-119208
pypdf is a pure-Python PDF library. Before 6.21.3, reading the page count of a crafted encrypted PDF trusts a forged /Count value, so an attacker can make the application spend excessive time and memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications that use pypdf to open encrypted PDFs from untrusted sources and read their page count are exposed. Apps that only process trusted PDFs or never open encrypted files can skip it, though upgrading is still the simple fix.
No product ranges from the sources yet.
pip show pypdf and see whether it is below 6.21.3.len(reader.pages) or reader.get_num_pages()) on PDFs uploaded or fetched from outside.6.21.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119208")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.