DEBIAN-CVE-2026-119209: Medium severity debian/pypdf vulnerability

Published Oct 29, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.

Affected Software

4 affected components

debian/pypdf*

debian/pypdf2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the ability to provide a crafted PDF that is opened by an application using pypdf. Exploitation requires local-level privileges according to the supplied vector, and no user interaction is required.

What is the impact of successful exploitation?

Opening the crafted PDF can cause pypdf to consume excessive memory, resulting in a denial of service. The supplied impact assessment indicates no confidentiality or integrity impact.

What PDF features are involved?

The issue involves cross-reference streams with very large declared entry counts. Highly compressible streams and /Prev chains can multiply parsed entries, and negative /Index counts can bypass the per-stream clamp.

What version contains the fix?

The issue is fixed in pypdf version 6.21.3. The provided data identifies Debian pypdf and pypdf2 as affected software but does not provide Debian package fixed versions.

DEBIAN-CVE-2026-119209: Medium severity debian/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

What PDF features are involved?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

What PDF features are involved?

What version contains the fix?