GHSA-62m5-6wh8-28x7: pypdf has possible long runtimes/large memory usage for encrypted PDF files

Q: Which applications are exposed to this issue?

Applications using pypdf versions before 6.21.3 are exposed if they process attacker-controlled encrypted PDFs and access their page count. The crafted file must contain a forged /Count value in its page tree.

Q: What must an attacker do to trigger the excessive resource use?

An attacker must provide a crafted encrypted PDF and cause the application to retrieve its page count. The issue can occur after the PDF has been successfully decrypted because the declared page count is not validated by walking the page tree.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4270. Upgrading to pypdf 6.21.3 fixes the issue.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4270.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.3

6.21.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·08:41 PM

Data Sourced

via OSV·08:41 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:08 PM

Data Sourced

via GitHub·11:08 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:08 PM

Affected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using pypdf versions before 6.21.3 are exposed if they process attacker-controlled encrypted PDFs and access their page count. The crafted file must contain a forged /Count value in its page tree.

What must an attacker do to trigger the excessive resource use?

An attacker must provide a crafted encrypted PDF and cause the application to retrieve its page count. The issue can occur after the PDF has been successfully decrypted because the declared page count is not validated by walking the page tree.

What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4270. Upgrading to pypdf 6.21.3 fixes the issue.

GHSA-62m5-6wh8-28x7: pypdf has possible long runtimes/large memory usage for encrypted PDF files

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to trigger the excessive resource use?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to trigger the excessive resource use?

What can be done if upgrading is not immediately possible?