DEBIAN-CVE-2026-119208: High severity debian/pypdf vulnerability

Published Oct 29, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.

Affected Software

4 affected components

debian/pypdf*

debian/pypdf2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications using pypdf or pypdf2 that decrypt attacker-controlled PDFs and access their page count are exposed. The impact is excessive time and memory consumption, which can cause a denial of service.

What does an attacker need to do to trigger the problem?

An attacker needs to supply a crafted encrypted PDF with a forged /Count value in its page tree. User interaction is required according to the severity vector, and the application must successfully decrypt the PDF and retrieve its page count.

Are default installations affected?

The available data does not establish whether a default Debian installation includes or invokes pypdf or pypdf2. Exposure depends on whether an application processes untrusted encrypted PDFs and accesses page counts.

What is the available remediation?

Upgrade pypdf to version 6.21.3 or later, which fixes the issue. The provided data does not specify a separate mitigation for cases where upgrading is not immediately possible.

DEBIAN-CVE-2026-119208: High severity debian/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to do to trigger the problem?

Are default installations affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to do to trigger the problem?

Are default installations affected?

What is the available remediation?