{"id":"CVE-2026-119208","kind":"vulnerability","aliases":["CVE-2026-119208"],"related":[],"title":"pypdf: forged page count in encrypted PDFs exhausts time and memory","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.","summary":"pypdf is a pure-Python PDF library. Before 6.21.3, reading the page count of a crafted encrypted PDF trusts a forged /Count value, so an attacker can make the application spend excessive time and memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pypdf","python"],"not_affected_if":["no-encrypted-pdfs","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show pypdf` and see whether it is below `6.21.3`.\n- Search your code and services for calls that read the page count (for example `len(reader.pages)` or `reader.get_num_pages()`) on PDFs uploaded or fetched from outside.","fix":"- Upgrade pypdf to `6.21.3`.","status":"open","published_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:37+00:00","updated_at":"2026-10-29T21:28:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T21:28:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pypdf to `6.21.3`.","reach":"internet","title":"pypdf: forged page count in encrypted PDFs exhausts time and memory","impact":"medium","summary":"pypdf is a pure-Python PDF library. Before 6.21.3, reading the page count of a crafted encrypted PDF trusts a forged /Count value, so an attacker can make the application spend excessive time and memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker causes excessive CPU and memory use, denying service to the app","analyst_note":"","how_to_check":"- Check the installed version with `pip show pypdf` and see whether it is below `6.21.3`.\n- Search your code and services for calls that read the page count (for example `len(reader.pages)` or `reader.get_num_pages()`) on PDFs uploaded or fetched from outside.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-encrypted-pdfs"],"who_is_affected":"Applications that use pypdf to open encrypted PDFs from untrusted sources and read their page count are exposed. Apps that only process trusted PDFs or never open encrypted files can skip it, though upgrading is still the simple fix.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4165,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119208':14A,17A '-2026':13A,16A '/count':43B,98C '6.21.3':30B,72C,138C 'access':83C 'allow':119C 'applic':51B,82C 'attack':47B,122C 'attacker-control':121C 'consum':75C 'control':123C 'count':4A,34B,86C,106C,112C 'craft':37B,89C 'cve':12A,15A 'declar':95C,111C 'decrypt':103C 'drive':126C 'encrypt':6A,38B,90C 'even':100C 'excess':53B,76C,127C 'exhaust':8A 'fix':135C 'forg':2A,42B,97C 'free':60C 'instead':113C 'issu':133C 'librari':28B,69C 'make':49B 'memori':11A,56B,79C,130C 'open':63C 'open-sourc':62C 'packag':18B 'page':3A,33B,85C,93C,105C,117C 'page-count':104C 'pdf':27B,39B,68C,91C 'pdfs':7A 'prior':70C 'pure':25B,66C 'pure-python':24B,65C 'pypdf':1A,19B,21B,57C,73C 'python':20B,26B,67C 'read':31B 'retriev':107C 'sourc':64C 'spend':52B 'success':102C 'time':9A,54B,77C 'tree':94C,118C 'trust':40B,108C 'unvalid':110C 'use':131C 'valu':44B,99C,124C 'version':137C 'walk':115C 'whose':92C 'work':128C","nicknames":[],"mitigations":[],"who_affected":"Applications that use pypdf to open encrypted PDFs from untrusted sources and read their page count are exposed. Apps that only process trusted PDFs or never open encrypted files can skip it, though upgrading is still the simple fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119208","severity":null,"published_at":"2026-10-29T21:17:20+00:00","modified_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}