CVE-2026-119204 in pypdf
Summary
by MITRE • 10/29/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in pypdf versions prior to 6.21.4 represents a significant memory exhaustion flaw rooted in the library's handling of PDF page tree structures and resource inheritance mechanisms. As an open-source pure-Python library, pypdf is widely used for parsing, manipulating, and extracting data from Portable Document Format files. The core issue arises during the process of flattening the page tree, a common operation performed to simplify complex document structures or prepare them for further processing. In this context, the parser recursively copies page dictionaries and inherited resource entries without implementing any form of global budgeting or limit enforcement on the total number of shared resources allocated within a single document session.
This architectural oversight allows an attacker to craft a malicious PDF file that contains a deeply nested or excessively large tree structure with numerous shared resources. When pypdf processes such a crafted document, it attempts to resolve and copy these inherited entries for every page in the document without checking against a cumulative limit. Consequently, the library engages in disproportionate memory allocations, rapidly consuming available system RAM. This behavior is characteristic of an Uncontrolled Resource Consumption vulnerability, aligning with CWE-770 which describes situations where software does not properly control the allocation and maintenance of limited resources, leading to resource exhaustion.
The operational impact of this flaw is primarily a denial-of-service condition for applications relying on pypdf for PDF processing. By triggering excessive memory usage, an attacker can cause the host application or system to become unresponsive as it attempts to satisfy the massive allocation requests. In environments with limited memory resources or strict quotas, such as serverless functions or containers with constrained RAM limits, this vulnerability can lead to immediate process termination via out-of-memory errors. Furthermore, in scenarios where multiple users upload PDFs for processing, a single crafted file could degrade performance for other concurrent operations by monopolizing system memory, thereby affecting the availability and stability of the entire service infrastructure.
From an offensive security perspective, this flaw maps directly to MITRE ATT&CK technique T1496 Resource Hijacking, specifically under the sub-technique of resource consumption through denial-of-service attacks. The vulnerability does not typically lead to remote code execution or data exfiltration but serves as a potent vector for disrupting service availability. It highlights the risks associated with parsing untrusted input formats without strict bounds checking on recursive operations and object instantiation counts.
To mitigate this risk, organizations utilizing pypdf must upgrade immediately to version 6.21.4 or later, where the developers have implemented safeguards to enforce document-wide entry budgets during page-tree flattening. This fix ensures that resource allocation is capped relative to the overall size of the PDF structure rather than allowing unbounded growth based on crafted input patterns. Additionally, defensive measures should include implementing memory limits at the application level using sandboxing techniques or container constraints to prevent any single process from consuming excessive system resources regardless of the underlying library version. Input validation strategies that limit the depth and complexity of parsed documents can also serve as an additional layer of defense against such resource exhaustion attacks.