CVE-2026-119204

MediumCVSS 5.5/10Last modified Nov 4, 2026

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
py-pdf	pypdf	< 6.21.4

References

https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79ePatch
https://github.com/py-pdf/pypdf/pull/4290Patch
https://github.com/py-pdf/pypdf/releases/tag/6.21.4Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54Patch, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1192055.5pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a cra CVE-2026-1192065.5pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a craft CVE-2026-1192075.5pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafte CVE-2026-1192085.5pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application ac CVE-2026-1192095.5pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF con CVE-2026-119219.1IBM Verify Identity Access containers may not apply management password change operations correctly.CVE-2026-1192105.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5 CVE-2026-1192114.9The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions CVE-2026-1192133.7The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linke CVE-2026-1192157.6Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a CVE-2026-1192185.4The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url CVE-2026-1192195.4The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in a