CVE-2026-119208: pypdf has possible long runtimes/large memory usage for encrypted PDF files

October 30, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value.

References

github.com/advisories/GHSA-62m5-6wh8-28x7
github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b
github.com/py-pdf/pypdf/pull/4270
github.com/py-pdf/pypdf/releases/tag/6.21.3
github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7
nvd.nist.gov/vuln/detail/CVE-2026-119208

Code Behaviors & Features

Detect and mitigate CVE-2026-119208 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →