DEBIAN-CVE-2026-119204: High severity debian/pypdf vulnerability

Published Oct 29, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.

Affected Software

4 affected components

debian/pypdf*

debian/pypdf2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Debian deployments using pypdf or pypdf2 are affected if they use a pypdf version earlier than 6.21.4 and parse attacker-controlled or otherwise untrusted PDF files.

What does an attacker need to exploit this issue?

An attacker needs a crafted PDF with a page tree containing many shared resources to be parsed. The provided severity data indicates no privileges are required, but user interaction is required.

What is the impact of successful exploitation?

Parsing the crafted PDF can cause disproportionate memory allocations and excessive memory consumption, potentially affecting the availability of the PDF-processing service or application.

What should be done if the affected library is in use?

Update to pypdf version 6.21.4 or later, which fixes the issue. Until updated, avoid processing untrusted PDFs where possible.

DEBIAN-CVE-2026-119204: High severity debian/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be done if the affected library is in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be done if the affected library is in use?