CVE-2026-119207: pypdf has possible large memory usage for exceptions in strict mode

October 30, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary.

References

github.com/advisories/GHSA-4vqv-7265-gm2w
github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d
github.com/py-pdf/pypdf/pull/4265
github.com/py-pdf/pypdf/releases/tag/6.21.3
github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
nvd.nist.gov/vuln/detail/CVE-2026-119207

Code Behaviors & Features

Detect and mitigate CVE-2026-119207 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →