CVE-2026-119208: 
Python vulnerability analysis and mitigation

CVE-2026-119208 is a denial-of-service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by uncontrolled resource consumption when processing crafted encrypted PDF files. Prior to version 6.21.3, pypdf's get_num_pages() function trusts the unvalidated /Count value declared in an encrypted PDF's page tree rather than walking the actual page tree after decryption, allowing an attacker-controlled forged count to drive excessive CPU time and memory usage. The vulnerability affects all pypdf versions before 6.21.3 and was disclosed on October 27–29, 2026. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-400 (Uncontrolled Resource Consumption): the get_num_pages() method in pypdf/_doc_common.py returned the raw /Pages /Count value for any document with an /Encrypt entry, even after a successful decrypt() call. Because the /Count field is attacker-controlled and not validated against the actual page tree structure, a forged large integer can cause downstream operations such as page_labels to perform huge allocations and iterations. Exploitation requires no privileges and only passive user interaction — an application must open and access the page count of a malicious encrypted PDF supplied by the attacker. The fix (PR #4270, commit 82b9195) changes the logic so that once the document is decrypted, the library walks the actual page tree instead of trusting the declared count (GitHub PR #4270, GitHub Commit).

Successful exploitation causes the affected application to consume excessive CPU time and memory, potentially resulting in a denial-of-service condition — hanging the process or exhausting system resources. Any service that accepts user-supplied PDF files and processes their page count (e.g., document management systems, PDF converters, or web applications using pypdf) is at risk. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is network-accessible with low complexity and no required privileges, but passive user interaction (an application must process the malicious PDF) is needed (Feedly, GitHub Advisory).

1. Craft malicious PDF: Create an encrypted PDF file where the /Pages dictionary's /Count value is set to an arbitrarily large integer (e.g., 2,147,483,647) that does not reflect the actual number of pages in the document.
2. Encrypt the PDF: Apply standard PDF encryption (e.g., with an empty or known password) so that the /Encrypt entry is present, triggering the vulnerable code path in get_num_pages().
3. Deliver the PDF: Submit the crafted PDF to a target application that uses pypdf to process user-supplied documents — for example, via a file upload endpoint, email attachment processor, or document conversion service.
4. Trigger page count access: The application calls get_num_pages() or accesses reader.pages / reader.page_labels after decryption, causing pypdf to use the forged /Count value and drive excessive memory allocation and CPU consumption.
5. Achieve denial of service: The application process hangs or is killed by the OS due to resource exhaustion, resulting in service unavailability (GitHub PR #4270, GitHub Advisory).

• File System: Presence of encrypted PDF files with a /Pages /Count value vastly exceeding the actual number of pages in the document (detectable via PDF forensic tools such as pdfid or pdf-parser).
• Process: Python processes consuming abnormally high memory or CPU for extended periods while processing PDF files; processes associated with pypdf-based applications that become unresponsive or are OOM-killed.
• Logs: Application logs showing timeouts, memory errors, or crashes during PDF page count or page label retrieval operations; error messages referencing get_num_pages(), page_labels, or _flatten() in pypdf stack traces.

Upgrade pypdf to version 6.21.3 or later, which validates the page count by walking the actual page tree after decryption rather than trusting the declared /Count value. For deployments that cannot upgrade immediately, the pypdf maintainers recommend manually applying the changes from PR #4270 as a workaround. Additionally, consider implementing file size and processing time limits for PDF ingestion pipelines to reduce the impact of resource exhaustion attacks (GitHub Advisory, pypdf Release 6.21.3).

The vulnerability was reported by researcher DharmendraSoni5110 and fixed by pypdf maintainer stefan6419846 via PR #4270, merged on October 27, 2026. The advisory was rated "Moderate" severity by the pypdf project, reflecting the limited scope (availability only, no data exposure). No significant broader media coverage or notable community commentary beyond the GitHub advisory and associated pull request has been identified (GitHub Advisory, GitHub PR #4270).