Resource exhaustion in PyPDF - CVE-2026-119209
Published: November 9, 2026
Vulnerability identifier: #VU162817
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119209
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to cause excessive memory consumption in applications that open PDF files using pypdf.
The vulnerability exists due to uncontrolled resource consumption in pypdf's cross-reference stream parsing when a specially crafted PDF file is opened. An unauthenticated attacker can craft a PDF containing cross-reference streams and cause large memory usage when a victim opens the file.
Affected software
PyPDF
How to mitigate CVE-2026-119209
Install security update from vendor's website.
PyPDF - update to 6.21.3