Vulnerability GHSA-cggf-277g-3q54
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 hours ago
October 30, 2026 at 11:13 PM UTC
pypdf has possible large memory usage when parsing page tree
1.0 - 6.21.3
1.0 - 6.21.3
Summary
pypdf has possible large memory usage when parsing page tree
Details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4290.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
1.0 - 6.21.3 GHSA-5849-834g-hvw5
1.0 - 6.21.3 GHSA-5849-834g-hvw5
High Risk
4 hours ago
pypdf has possible infinite loop when cloning dictionaries
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
High Risk
4 hours ago
pypdf has possible long runtimes when retrieving page labels
1.0 - 6.21.2 GHSA-42gh-23hr-vphw
1.0 - 6.21.2 GHSA-42gh-23hr-vphw
High Risk
4 hours ago
pypdf has possible large memory usage for exceptions in strict mode
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
High Risk
4 hours ago
pypdf has possible long runtimes/large memory usage for encrypted PDF files
1.0 - 6.21.2 GHSA-62m5-6wh8-28x7
1.0 - 6.21.2 GHSA-62m5-6wh8-28x7
Impacted packages
Timeline
Published
4 hours ago
October 30, 2026 at 11:13 PM UTC
Fixed (6.21.4)
2 days ago
October 28, 2026 at 05:00 PM UTC
Last Modified
4 hours ago
October 30, 2026 at 11:30 PM UTC