CVE-2026-119209 in pypdf
Summary
by MITRE • 10/29/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within the pypdf library represents a significant resource exhaustion flaw stemming from improper validation and handling of cross-reference streams in PDF documents. As an open-source Python library designed for parsing, manipulating, and generating PDF files, pypdf is frequently utilized by developers to automate document processing tasks. The core issue arises when the parser encounters crafted PDFs containing maliciously constructed cross-reference streams that declare excessively large entry counts. In a standard PDF structure, the cross-reference table or stream serves as an index mapping object offsets within the file, allowing readers to locate specific objects efficiently without scanning the entire file sequentially. When this metadata is manipulated by an attacker, it can trick the parser into allocating memory resources far beyond what is necessary for legitimate document processing, leading to a denial of service condition through resource exhaustion rather than arbitrary code execution in most contexts involving pure Python parsers like pypdf prior to version 6.21.3.
The technical mechanism behind this vulnerability involves several interacting factors within the PDF specification implementation. First, highly compressible streams can be exploited because they allow an attacker to pack a massive number of logical entries into a relatively small file size on disk. When decompressed during parsing, these streams expand significantly, causing the parser to attempt processing thousands or millions of object references that were not anticipated by standard usage patterns. Second, the use of /Prev chains in cross-reference streams allows for multiple cross-reference sections within a single document. An attacker can chain these sections together such that each subsequent section adds more entries than the previous one, effectively multiplying the total number of parsed entries across the entire document structure. This compounding effect exacerbates memory consumption as the parser traverses the linked list of cross-reference streams.
Furthermore, the vulnerability is exacerbated by a logic error regarding negative /Index counts within these streams. The PDF specification allows for index arrays that define ranges of object numbers and their generation numbers. Prior to the fix in version 6.21.3, pypdf failed to adequately clamp or validate negative values in these index definitions. By specifying negative indices, an attacker could bypass existing per-stream limits designed to prevent excessive memory allocation. This bypass allowed for the creation of internal data structures that grew uncontrollably large during the parsing phase, leading to severe performance degradation or complete application crash due to out-of-memory errors. The lack of strict bounds checking on these specific fields meant that maliciously crafted inputs could trigger disproportionate resource consumption relative to the actual file size delivered over the network.
The operational impact of this vulnerability is primarily centered around availability and reliability for applications relying on pypdf for document ingestion. Systems that process untrusted PDF uploads, such as web portals, email gateways with attachment scanning, or automated data extraction pipelines, are at risk of experiencing service interruptions. An attacker can trigger a denial of service by sending a small but maliciously crafted PDF file to the vulnerable application. The resulting memory spike may not only crash the specific process handling the request but could also destabilize the host system if resource limits are not strictly enforced via containerization or operating-level controls. This aligns with CWE-400, which describes uncontrolled resource consumption, and maps to MITRE ATT&CK technique T1496, Resource Hijacking, where attackers consume resources to degrade service availability for legitimate users.
Mitigation strategies focus on immediate software updates and defensive coding practices. The primary remediation is to upgrade pypdf to version 6.21.3 or later, which includes patches that enforce stricter validation of cross-reference stream entries and properly clamp index values to prevent bypassing memory limits. For environments where upgrading immediately is not feasible, developers should implement input sanitization layers before passing PDF data to the parser. This can include validating file sizes against expected thresholds, limiting the depth of /Prev chain traversals, or using sandboxed execution environments with strict memory quotas for parsing operations. Additionally, integrating a secondary validation step that checks the structural integrity and entry counts of parsed documents can provide an additional layer of defense against such resource exhaustion attacks. Regularly monitoring application logs for unusual spikes in memory usage during PDF processing events can also aid in early detection of exploitation attempts.