CVE-2026-119207: CVE-2026-119207: Asymmetric Resource Consumption in pypdf Dictionary Parser

#security #cve #cybersecurity

CVE-2026-119207: Asymmetric Resource Consumption in pypdf Dictionary Parser

Vulnerability ID: CVE-2026-119207
CVSS Score: 7.1
Published: 2026-10-30

CVE-2026-119207 (GHSA-4vqv-7265-gm2w) is an asymmetric resource consumption and denial-of-service (DoS) vulnerability in the open-source Python PDF manipulation library pypdf. In versions prior to 6.21.3, the DictionaryObject.read_from_stream method fails to bound exception message lengths when encountering malformed, unclosed dictionary structures in strict mode. When nested dictionary parsing fails, each level catches the inner exception and raises a new PdfReadError initialized with the string representation (exc.repr()) of the caught exception. This recursive wrapping causes geometric string expansion across the call stack, enabling a minimal PDF payload of a few hundred bytes to exhaust gigabytes of heap memory and crash the host Python process.

TL;DR

Versions of pypdf prior to 6.21.3 suffer from geometric exception string expansion when parsing nested, unclosed PDF dictionaries with strict=True. A tiny crafted PDF payload can force the parser to allocate gigabytes of memory via recursive exc.repr() wrapping, resulting in an Out-Of-Memory (OOM) denial of service.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-119207 (GHSA-4vqv-7265-gm2w)
Vulnerability Class: CWE-400 (Uncontrolled Resource Consumption) / CWE-405 (Asymmetric Resource Consumption)
CVSS v4.0 Score: 7.1 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
Affected Component: DictionaryObject.read_from_stream in pypdf/generic/_data_structures.py
Affected Versions: pypdf < 6.21.3 (when strict=True is enabled)
Patched Version: pypdf >= 6.21.3
EPSS Score: 0.30% (23.18th percentile)
Primary Impact: Application Denial of Service via O(2^N) heap memory exhaustion

Affected Systems

pypdf (Python Package Index / PyPI)
Python applications and document processing pipelines utilizing pypdf < 6.21.3 with strict=True
pypdf: < 6.21.3 (Fixed in: 6.21.3)

Code Analysis

Commit: 6427025

SEC: Avoid excessive error messages (#4265)

--- a/pypdf/generic/_data_structures.py
+++ b/pypdf/generic/_data_structures.py
@@ -673,12 +679,12 @@ def read_from_stream(
             except LimitReachedError:
                 # Always propagate security issues.
                 raise
-            except RecursionError as exc:
-                raise PdfReadError(exc.__repr__()) from exc
+            except (MemoryError, RecursionError) as exc:
+                raise PdfReadError("Error reading PDF file.") from exc
             except Exception as exc:
                 if pdf is not None and pdf.strict:
-                    raise PdfReadError(exc.__repr__()) from exc
-                logger_warning("%(exception)r", source=__name__, exception=exc)
+                    raise PdfReadError("Error reading PDF file.") from exc
+                logger_warning("%(exception)s", source=__name__, exception=repr(exc)[:500])
                 retval = DictionaryObject()
                 retval.update(data)
                 return retval  # return partial data

Mitigation Strategies

Upgrade pypdf to version 6.21.3 or later to eliminate recursive exception string expansion.
Disable strict parsing mode (set strict=False) when initializing PdfReader on untrusted PDF inputs.
Isolate PDF parsing operations inside dedicated worker processes or containers with enforced cgroup memory limits.
Enforce process-level virtual memory limits using Python's resource.setrlimit(resource.RLIMIT_AS, ...) on Unix platforms.

Remediation Steps:

Audit application dependencies (requirements.txt, Pipfile.lock, poetry.lock) to identify pypdf versions prior to 6.21.3.
Run 'pip install --upgrade "pypdf>=6.21.3"' in all affected build pipelines and runtime environments.
Verify that custom error handlers wrapping pypdf operations do not broadly catch Exception without re-raising MemoryError.
Run regression tests to confirm application compatibility with the static PdfReadError('Error reading PDF file.') message format.

References

Read the full report for CVE-2026-119207 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community