CVE-2026-119208: pypdf has possible long runtimes/large memory usage for encrypted PDF files
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4270.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Compensating control
If unable to upgrade to pypdf 6.21.3, apply the changes from PR #4270.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications using pypdf before 6.21.3 that accept or process untrusted encrypted PDF files are exposed when their workflow retrieves a document's page count. The affected package listings include pip pypdf, Debian pypdf and pypdf2, and Ubuntu pypdf.
What must an attacker do to trigger the resource exhaustion?
The attacker must provide a crafted encrypted PDF with a forged /Count value in its page tree and cause the application to access the PDF's page count. No attacker privileges are required, but the crafted file must be processed by the affected application.
What should be done if an immediate upgrade is not possible?
Upgrade to pypdf 6.21.3 when possible. If upgrading is not yet feasible, apply the changes from PR #4270 as the documented workaround.
How can I determine whether an application is affected?
Check whether it uses pypdf earlier than 6.21.3 and retrieves page counts from encrypted PDFs. Affected behavior can manifest as excessive runtime or memory consumption when processing a crafted encrypted PDF with an invalid declared /Count value.