CVE-2026-119208: CVE-2026-119208: Uncontrolled Resource Consumption in pypdf Encrypted Page Count Evaluation

#security #cve #cybersecurity

CVE-2026-119208: Uncontrolled Resource Consumption in pypdf Encrypted Page Count Evaluation

Vulnerability ID: CVE-2026-119208
CVSS Score: 7.1
Published: 2026-10-30

CVE-2026-119208 is an uncontrolled resource consumption vulnerability in the pypdf Python library prior to version 6.21.3. When processing an encrypted PDF file after successful decryption, the get_num_pages() method fails to verify whether the encryption handler has already unlocked the document. Consequently, pypdf returns the unvalidated /Count integer directly from the /Pages catalog dictionary instead of traversing and flattening the actual page tree. Attackers can supply an encrypted PDF with an artificially inflated /Count attribute to trigger excessive memory allocation and prolonged CPU usage during downstream operations such as page iteration or label resolution.

TL;DR

Versions of pypdf prior to 6.21.3 trust the unvalidated /Count metadata in encrypted PDFs even after decryption, enabling attackers to trigger memory exhaustion and CPU starvation via forged page counts.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-400: Uncontrolled Resource Consumption
Attack Vector: Network (Crafted Encrypted PDF File)
CVSS v4.0 Score: 7.1 High (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H)
EPSS Score: 0.30% (23.18th Percentile)
Affected Component: PdfDocCommon.get_num_pages() in pypdf/_doc_common.py
Impact: Denial of Service via Memory Exhaustion & CPU Lockup
Exploit Status: Proof-of-Concept Available (Unit Test Reproduction)
Patched Version: pypdf 6.21.3

Affected Systems

pypdf (Python Package Index / PyPI)
pypdf: < 6.21.3 (Fixed in: 6.21.3)

Code Analysis

Commit: 82b9195

SEC: Use the validated page count after decrypting a document (#4270)

diff --git a/pypdf/_doc_common.py b/pypdf/_doc_common.py
index d89d9745a8..1d358eafb7 100644
--- a/pypdf/_doc_common.py
+++ b/pypdf/_doc_common.py
@@ -377,10 +377,12 @@ def get_num_pages(self) -> int:
             PdfReadError: If restrictions prevent this action.

         """
-        # Flattened pages will not work on an encrypted PDF;
-        # the PDF file's page count is used in this case. Otherwise,
-        # the original method (flattened page count) is used.
-        if self.is_encrypted:
+        # The page tree cannot be walked while the document is still encrypted;
+        # the PDF file's page count is used in this case. Once the document has
+        # been decrypted (or if it is not encrypted at all), the flattened page
+        # tree is used instead, as the /Count value might be wrong.
+        encryption = self._encryption
+        if self.is_encrypted and (encryption is None or not encryption.is_decrypted()):
             return self.root_object["/Pages"]["/Count"]  # type: ignore[no-any-return, index]
         if self.flattened_pages is None:
             self._flatten(self._readonly)

Mitigation Strategies

Upgrade pypdf to version 6.21.3 or later to ensure decrypted documents validate page counts by flattening the page tree.
Enforce process-level memory limits (cgroups, ulimit, or resource.setrlimit) on worker processes handling untrusted PDF parsing.
Implement strict execution timeouts on background jobs and request handlers that ingest and decrypt PDF documents.
Explicitly invoke internal page tree flattening after decryption if running on legacy versions that cannot be immediately upgraded.

Remediation Steps:

Audit application dependencies (requirements.txt, pyproject.toml, Pipfile.lock) to identify installations of pypdf prior to 6.21.3.
Run pip install --upgrade "pypdf>=6.21.3" across affected environments and rebuild deployment containers.
Verify that unit and integration tests pass, specifically confirming that encrypted PDF workflows properly invoke reader.decrypt() prior to accessing page counts or labels.
Configure worker orchestration frameworks (such as Celery or Kubernetes pods) with appropriate memory limits and task timeouts.

References

Read the full report for CVE-2026-119208 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community