GHSA-x3rh-gjgm-fmqc: pypdf has possible large memory usage when parsing cross-reference streams

Severity: HIGH
CVE: CVE-2026-119209
Ecosystems: pip
Packages: pypdf

Written by

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.

### Patches

This has been fixed in [pypdf==6.21.3](https://github.com/py-pdf/pypdf/releases/tag/6.21.3).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4269](https://github.com/py-pdf/pypdf/pull/4269).

More posts