CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.

• CWE-400
• CWE-770

• https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4Patch
• https://github.com/py-pdf/pypdf/pull/4269Patch
• https://github.com/py-pdf/pypdf/releases/tag/6.21.3Release Notes
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqcPatch, Vendor Advisory

Published

Oct 29, 2026

Last Modified

Oct 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119203pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-119204pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-119205pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-119206pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-119207pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-119208pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-11921IBM Verify Identity Access containers may not apply manageme…9.1
• CVE-2026-119210MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-11922A vulnerability in zenml-io/zenml versions 0.57.0 through 0.…6.5
• CVE-2026-11923IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.4
• CVE-2026-119249A malicious actor with access to the network could exploit a…7.5
• CVE-2026-11925Tanium addressed a User Interface (UI) Misrepresentation of …2.7