low
advisory
pypdf: Potential large memory usage when parsing cross-reference streams (CVE-2026-119209)
The pypdf library may experience large memory usage when parsing crafted PDF files containing cross-reference streams.
CVE search metadata
CVE search record: CVE-2026-119209. Severity: medium. CVSS: 5.5. EPSS: 0.32%. KEV: no. Product: pypdf (< 6.21.3). Brief: pypdf: Potential large memory usage when parsing cross-reference streams (CVE-2026-119209). Brief link: https://feed.craftedsignal.io/briefs/2026-10-pypdf-memory-exhaustion-1402e87f/
Triage facts
Revision 1- Applicability
- pypdf (< 6.21.3)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 4 public sources
- Freshness
- Revision 1Oct 31, 09:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
An attacker can craft a PDF that leads to large memory usage when parsed by pypdf. This requires opening a file with cross-reference streams. This issue has been addressed in pypdf version 6.21.3.