Live › vulnerability › CVE-2026-119209
pypdf is a Python library for reading and writing PDF files. A crafted PDF with oversized cross-reference streams makes pypdf consume excessive memory while opening it, which can crash or stall the program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Any application that uses pypdf to open PDF files it did not create, such as uploads, document processing pipelines or batch jobs, is exposed on versions before 6.21.3. Applications that only process trusted, internally generated PDFs are at much lower risk. unknown beyond that from the sources.
No product ranges from the sources yet.
pip show pypdf or pip freeze | grep -i pypdf and compare the installed version against 6.21.3.6.21.3.6.21.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.