GHSA-cggf-277g-3q54: pypdf has possible large memory usage when parsing page tree

Q: Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.4 are affected when they parse attacker-crafted PDFs. The vulnerable behavior occurs during page-tree parsing and flattening.

Q: What does an attacker need to do to trigger the excessive memory use?

An attacker needs to provide a crafted PDF whose page tree contains many shared resources. Parsing that document can cause disproportionate memory allocations because page dictionaries and inherited resource entries are copied without a document-wide entry budget.

Q: Are users required to interact with the PDF for exploitation?

The supplied vector indicates user interaction is required. The vulnerable application must parse the crafted PDF page tree.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4290. The documented permanent fix is upgrading pypdf to version 6.21.4.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources.

Patches

This has been fixed in pypdf==6.21.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4290.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.4

6.21.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4
Compensating control
If upgrading is not yet possible, apply the changes from PR #4290.

Event History

Oct 29, 2026

CVE Published

via OSV·08:34 PM

Data Sourced

via OSV·08:34 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:13 PM

Data Sourced

via GitHub·11:13 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:13 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using pypdf versions prior to 6.21.4 are affected when they parse attacker-crafted PDFs. The vulnerable behavior occurs during page-tree parsing and flattening.

What does an attacker need to do to trigger the excessive memory use?

An attacker needs to provide a crafted PDF whose page tree contains many shared resources. Parsing that document can cause disproportionate memory allocations because page dictionaries and inherited resource entries are copied without a document-wide entry budget.

Are users required to interact with the PDF for exploitation?

The supplied vector indicates user interaction is required. The vulnerable application must parse the crafted PDF page tree.

What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4290. The documented permanent fix is upgrading pypdf to version 6.21.4.

GHSA-cggf-277g-3q54: pypdf has possible large memory usage when parsing page tree

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the excessive memory use?

Are users required to interact with the PDF for exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the excessive memory use?

Are users required to interact with the PDF for exploitation?

What can be done if upgrading is not immediately possible?