CVE-2026-119204: pypdf has possible large memory usage when parsing page tree
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4290.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.4 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.4 - Compensating control
If upgrading is not yet possible, apply the changes from pull request #4290.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that parse attacker-controlled or otherwise untrusted PDF files with pypdf are exposed. The impact is excessive memory consumption, which can affect availability when a crafted PDF is processed.
What must an attacker provide to trigger the excessive memory use?
The attacker needs to supply a crafted PDF whose page tree has many shared resources. Triggering occurs when the application parses that page tree; no attacker privileges are indicated.
Is a configuration change required for exploitation?
No special configuration requirement is described. Affected pypdf versions parse the crafted page-tree structure in a way that can allocate disproportionate memory.
What can be done if upgrading is not immediately possible?
Consider applying the changes from PR #4290 as a workaround. The documented fixed release is pypdf 6.21.4.
How can teams determine whether they may be affected?
Check whether the application uses pypdf to parse PDFs and whether its installed version is earlier than 6.21.4. Prioritize systems that process PDFs from untrusted sources or permit users to upload PDF files.