Vulnerability GHSA-x3rh-gjgm-fmqc
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 hours ago
October 30, 2026 at 11:07 PM UTC
pypdf has possible large memory usage when parsing cross-reference streams
1.0 - 6.21.2
1.0 - 6.21.2
Summary
pypdf has possible large memory usage when parsing cross-reference streams
Details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4269.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
1.0 - 6.21.3 GHSA-5849-834g-hvw5
1.0 - 6.21.3 GHSA-5849-834g-hvw5
High Risk
4 hours ago
pypdf has possible large memory usage when parsing page tree
1.0 - 6.21.3 GHSA-cggf-277g-3q54
1.0 - 6.21.3 GHSA-cggf-277g-3q54
High Risk
4 hours ago
pypdf has possible infinite loop when cloning dictionaries
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
High Risk
4 hours ago
pypdf has possible long runtimes when retrieving page labels
1.0 - 6.21.2 GHSA-42gh-23hr-vphw
1.0 - 6.21.2 GHSA-42gh-23hr-vphw
High Risk
4 hours ago
pypdf has possible large memory usage for exceptions in strict mode
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
Impacted packages
Timeline
Published
4 hours ago
October 30, 2026 at 11:07 PM UTC
Fixed (6.21.3)
3 days ago
October 27, 2026 at 12:16 PM UTC
Last Modified
4 hours ago
October 30, 2026 at 11:15 PM UTC