CVE-2026-119209: pypdf has possible large memory usage when parsing cross-reference streams
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4269.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4269.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application using affected pypdf versions to open attacker-controlled PDFs is exposed, particularly where untrusted documents can be submitted or processed. Exploitation requires the PDF to use cross-reference streams.
What must an attacker do to trigger the problem?
An attacker must persuade a user or application to open a crafted PDF. The crafted file can declare very large cross-reference entry counts; highly compressible streams and /Prev chains can increase the number of entries parsed, and negative /Index counts can bypass the existing per-stream clamp.
Is user interaction required?
Yes. The affected application must open the crafted PDF, reflected by the UI:P metric. No attacker privileges are required.
What should be done if upgrading is not immediately possible?
Apply the changes from PR #4269 as a workaround. Otherwise, avoid opening untrusted PDFs that contain cross-reference streams until the application can be upgraded.
What version fixes the issue?
The issue is fixed in pypdf 6.21.3. Versions prior to 6.21.3 can consume excessive memory when opening a crafted PDF with cross-reference streams.