DEBIAN-CVE-2026-119207: High severity debian/pypdf vulnerability

Published Oct 29, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.

Affected Software

4 affected components

debian/pypdf*

debian/pypdf2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf or pypdf2 that process attacker-controlled PDF files may be exposed, particularly when strict mode parses invalid PDF dictionaries. The issue can cause excessive memory consumption and affect availability.

What does an attacker need to exploit it?

An attacker needs to provide a crafted malformed PDF containing an invalid dictionary. The supplied severity vector indicates no privileges are required, but user interaction is required.

What version contains the fix?

The issue is fixed in pypdf version 6.21.3. The provided data does not specify Debian package versions containing the fix.

DEBIAN-CVE-2026-119207: High severity debian/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What version contains the fix?