{"id":"CVE-2026-119209","kind":"vulnerability","aliases":["CVE-2026-119209"],"related":[],"title":"pypdf: crafted PDF can exhaust memory when opened","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.","summary":"pypdf is a Python library for reading and writing PDF files. A crafted PDF with oversized cross-reference streams makes pypdf consume excessive memory while opening it, which can crash or stall the program.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","package","pypdf","python"],"not_affected_if":["pypdf-not-used","trusted-input-only"],"how_to_check":"- Run `pip show pypdf` or `pip freeze | grep -i pypdf` and compare the installed version against `6.21.3`.\n- Search your lock files and requirements for pypdf pins below `6.21.3`.","fix":"- Upgrade pypdf to `6.21.3` or later.","status":"open","published_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:37+00:00","updated_at":"2026-10-29T21:28:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T21:28:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pypdf to `6.21.3` or later.","reach":"unknown","title":"pypdf: crafted PDF can exhaust memory when opened","impact":"low","summary":"pypdf is a Python library for reading and writing PDF files. A crafted PDF with oversized cross-reference streams makes pypdf consume excessive memory while opening it, which can crash or stall the program.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf","document-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Opening a crafted PDF exhausts memory and crashes the process","analyst_note":"","how_to_check":"- Run `pip show pypdf` or `pip freeze | grep -i pypdf` and compare the installed version against `6.21.3`.\n- Search your lock files and requirements for pypdf pins below `6.21.3`.","plain_action":"","needs_analyst":false,"not_affected_if":["pypdf-not-used","trusted-input-only"],"who_is_affected":"Any application that uses pypdf to open PDF files it did not create, such as uploads, document processing pipelines or batch jobs, is exposed on versions before 6.21.3. Applications that only process trusted, internally generated PDFs are at much lower risk. unknown beyond that from the sources.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":4148,"output_tokens":508,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119209':11A,14A '-2026':10A,13A '/index':111C '/prev':97C '6.21.3':71C,127C 'across':106C 'bypass':114C 'chain':98C 'clamp':120C 'compress':94C 'consum':43B,74C 'contain':82C 'count':92C,112C 'craft':2A,33B,80C 'crash':51B 'cross':38B,84C 'cross-refer':37B,83C 'cve':9A,12A 'declar':88C 'document':16B,108C 'document-process':15B 'entri':91C,105C 'excess':44B,75C 'exhaust':5A 'exist':116C 'file':31B 'fix':124C 'free':59C 'high':93C 'issu':122C 'larg':90C 'librari':25B,68C 'make':41B 'memori':6A,45B,76C 'multipli':100C 'negat':110C 'number':102C 'open':8A,47B,62C,78C 'open-sourc':61C 'overs':36B 'packag':18B 'pars':104C 'pdf':3A,30B,34B,67C,81C 'per':118C 'per-stream':117C 'prior':69C 'process':17B 'program':55B 'pure':65C 'pure-python':64C 'pypdf':1A,19B,21B,42B,56C,72C 'python':20B,24B,66C 'read':27B 'refer':39B,85C 'sourc':63C 'stall':53B 'stream':40B,86C,95C,119C 'version':126C 'write':29B","nicknames":[],"mitigations":[],"who_affected":"Any application that uses pypdf to open PDF files it did not create, such as uploads, document processing pipelines or batch jobs, is exposed on versions before 6.21.3. Applications that only process trusted, internally generated PDFs are at much lower risk. unknown beyond that from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119209","severity":null,"published_at":"2026-10-29T21:17:20+00:00","modified_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}