GHSA-4vqv-7265-gm2w: pypdf has possible large memory usage for exceptions in strict mode

Q: Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.3 are affected when they load crafted invalid PDF dictionaries with strict mode enabled. The issue can cause excessive memory consumption through amplified exception messages.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted malformed PDF containing an invalid dictionary that is processed by pypdf in strict mode. The supplied information does not indicate that authentication or prior privileges are required, but it does indicate user interaction is required.

Q: Does upgrading resolve the issue?

Yes. The issue is fixed in pypdf version 6.21.3.

Q: What can be done if an upgrade is not immediately possible?

Consider applying the changes from PR #4265 as a workaround.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4265.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.3

6.21.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·08:38 PM

Data Sourced

via OSV·08:38 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:08 PM

Data Sourced

via GitHub·11:08 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:08 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.3 are affected when they load crafted invalid PDF dictionaries with strict mode enabled. The issue can cause excessive memory consumption through amplified exception messages.

What does an attacker need to exploit it?

An attacker needs to provide a crafted malformed PDF containing an invalid dictionary that is processed by pypdf in strict mode. The supplied information does not indicate that authentication or prior privileges are required, but it does indicate user interaction is required.

Does upgrading resolve the issue?

Yes. The issue is fixed in pypdf version 6.21.3.

What can be done if an upgrade is not immediately possible?

Consider applying the changes from PR #4265 as a workaround.

GHSA-4vqv-7265-gm2w: pypdf has possible large memory usage for exceptions in strict mode

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does upgrading resolve the issue?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does upgrading resolve the issue?

What can be done if an upgrade is not immediately possible?