JEDI-SEC | Security Research & Digital Defense

GHSA-62m5-6wh8-28×7: pypdf has possible long runtimes/large memory usage for encrypted PDF files

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-119208
  • Ecosystems: pip
  • Packages: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong `/Count` value.

### Patches

This has been fixed in [pypdf==6.21.3](https://github.com/py-pdf/pypdf/releases/tag/6.21.3).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4270](https://github.com/py-pdf/pypdf/pull/4270).

Source: GitHub Security Advisories · 2026-10-30

More posts