CVE-2026-119207: pypdf has possible large memory usage for exceptions in strict mode
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4265.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Compensating control
If unable to upgrade, apply the changes from PR #4265.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions prior to 6.21.3 are affected when strict mode processes a crafted PDF containing an invalid dictionary. The issue can affect software that accepts attacker-controlled PDFs for parsing.
What does an attacker need to do to trigger the excessive memory use?
An attacker needs to provide a malformed PDF with an invalid dictionary that causes nested parsing failures in strict mode. No privileges are indicated, but user interaction is required according to the supplied severity vector.
What should be done if upgrading is not immediately possible?
Apply the changes from PR #4265 as a workaround. Otherwise, avoid processing untrusted malformed PDFs in strict mode until the fix can be deployed.
How can I determine whether my installation is affected?
Check the installed pypdf version and whether strict mode is used to load PDFs. Versions before 6.21.3 that parse crafted invalid PDF dictionaries in strict mode are affected.