CVE-2026-119207: Asymmetric Resource Consumption in pypdf Dictionary Parser

Vulnerability ID: CVE-2026-119207
CVSS Score: 7.1
Published: 2026-10-30

CVE-2026-119207 (GHSA-4vqv-7265-gm2w) is an asymmetric resource consumption and denial-of-service (DoS) vulnerability in the open-source Python PDF manipulation library pypdf. In versions prior to 6.21.3, the DictionaryObject.read_from_stream method fails to bound exception message lengths when encountering malformed, unclosed dictionary structures in strict mode. When nested dictionary parsing fails, each level catches the inner exception and raises a new PdfReadError initialized with the string representation (exc.repr()) of the caught exception. This recursive wrapping causes geometric string expansion across the call stack, enabling a minimal PDF payload of a few hundred bytes to exhaust gigabytes of heap memory and crash the host Python process.

TL;DR

Versions of pypdf prior to 6.21.3 suffer from geometric exception string expansion when parsing nested, unclosed PDF dictionaries with strict=True. A tiny crafted PDF payload can force the parser to allocate gigabytes of memory via recursive exc.repr() wrapping, resulting in an Out-Of-Memory (OOM) denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-119207 (GHSA-4vqv-7265-gm2w)
  • Vulnerability Class: CWE-400 (Uncontrolled Resource Consumption) / CWE-405 (Asymmetric Resource Consumption)
  • CVSS v4.0 Score: 7.1 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
  • Affected Component: DictionaryObject.read_from_stream in pypdf/generic/_data_structures.py
  • Affected Versions: pypdf < 6.21.3 (when strict=True is enabled)
  • Patched Version: pypdf >= 6.21.3
  • EPSS Score: 0.30% (23.18th percentile)
  • Primary Impact: Application Denial of Service via O(2^N) heap memory exhaustion

Affected Systems

  • pypdf (Python Package Index / PyPI)
  • Python applications and document processing pipelines utilizing pypdf < 6.21.3 with strict=True
  • pypdf: < 6.21.3 (Fixed in: 6.21.3)

Code Analysis

Commit: 6427025

SEC: Avoid excessive error messages (#4265)

--- a/pypdf/generic/_data_structures.py +++ b/pypdf/generic/_data_structures.py @@ -673,12 +679,12 @@ def read_from_stream( except LimitReachedError: # Always propagate security issues. raise - except RecursionError as exc: - raise PdfReadError(exc.__repr__()) from exc + except (MemoryError, RecursionError) as exc: + raise PdfReadError("Error reading PDF file.") from exc  except Exception as exc: if pdf is not None and pdf.strict: - raise PdfReadError(exc.__repr__()) from exc - logger_warning("%(exception)r", source=__name__, exception=exc) + raise PdfReadError("Error reading PDF file.") from exc + logger_warning("%(exception)s", source=__name__, exception=repr(exc)[:500])  retval = DictionaryObject() retval.update(data) return retval # return partial data

Mitigation Strategies

  • Upgrade pypdf to version 6.21.3 or later to eliminate recursive exception string expansion.
  • Disable strict parsing mode (set strict=False) when initializing PdfReader on untrusted PDF inputs.
  • Isolate PDF parsing operations inside dedicated worker processes or containers with enforced cgroup memory limits.
  • Enforce process-level virtual memory limits using Python's resource.setrlimit(resource.RLIMIT_AS, ...) on Unix platforms.

Remediation Steps:

  1. Audit application dependencies (requirements.txt, Pipfile.lock, poetry.lock) to identify pypdf versions prior to 6.21.3.
  2. Run 'pip install --upgrade "pypdf>=6.21.3"' in all affected build pipelines and runtime environments.
  3. Verify that custom error handlers wrapping pypdf operations do not broadly catch Exception without re-raising MemoryError.
  4. Run regression tests to confirm application compatibility with the static PdfReadError('Error reading PDF file.') message format.

References

Read the full report for CVE-2026-119207 on our website for more details including interactive diagrams and full exploit analysis.