GHSA-x3rh-gjgm-fmqc: pypdf has possible large memory usage when parsing cross-reference streams

Q: Which deployments are exposed to this issue?

Applications using pypdf versions before 6.21.3 are affected when they open attacker-crafted PDFs containing cross-reference streams. The impact is excessive memory consumption and potential availability disruption.

Q: What must an attacker provide to trigger the problem?

The attacker needs a victim to open a crafted PDF. The file uses cross-reference streams with very large declared entry counts; highly compressible streams, /Prev chains, and negative /Index counts can increase the number of entries pypdf parses.

Q: Are applications affected simply by having pypdf installed?

No. Exploitation requires pypdf to open a malicious PDF with cross-reference streams, so exposure depends on whether the application processes untrusted or attacker-influenced PDF files.

Q: What can be done if upgrading is not immediately possible?

Apply the changes from PR #4269 as a workaround. Otherwise, avoid opening untrusted PDFs with affected pypdf versions until the application can be upgraded to 6.21.3.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4269.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.3

6.21.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3

Event History

Oct 29, 2026

CVE Published

via OSV·08:43 PM

Data Sourced

via OSV·08:43 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:07 PM

Data Sourced

via GitHub·11:07 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:07 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using pypdf versions before 6.21.3 are affected when they open attacker-crafted PDFs containing cross-reference streams. The impact is excessive memory consumption and potential availability disruption.

What must an attacker provide to trigger the problem?

The attacker needs a victim to open a crafted PDF. The file uses cross-reference streams with very large declared entry counts; highly compressible streams, /Prev chains, and negative /Index counts can increase the number of entries pypdf parses.

Are applications affected simply by having pypdf installed?

No. Exploitation requires pypdf to open a malicious PDF with cross-reference streams, so exposure depends on whether the application processes untrusted or attacker-influenced PDF files.

What can be done if upgrading is not immediately possible?

Apply the changes from PR #4269 as a workaround. Otherwise, avoid opening untrusted PDFs with affected pypdf versions until the application can be upgraded to 6.21.3.

GHSA-x3rh-gjgm-fmqc: pypdf has possible large memory usage when parsing cross-reference streams

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the problem?

Are applications affected simply by having pypdf installed?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the problem?

Are applications affected simply by having pypdf installed?

What can be done if upgrading is not immediately possible?