CVE-2026-119204: CVE-2026-119204: Uncontrolled Resource Consumption in pypdf Page Tree Flattening

CVE-2026-119204 is a Denial of Service vulnerability affecting earlier versions of the pypdf library, specifically those before version 6.21.4. The issue arises from an uncontrolled resource consumption (CWE-400) during the flattening of a PDF document's page tree. By supplying a specially crafted PDF file with a hierarchical amplification structure of shared /Pages and /Page nodes, an attacker can cause pypdf to consume excessive memory, leading to a heap memory exhaustion and potential process termination.

The vulnerability is due to the lack of a global budget for copied dictionary entries when flattening the page tree. By referencing shared page nodes multiple times, an attacker can trigger an exponential increase in memory allocation, ultimately resulting in a denial of service. The CVSS score for this vulnerability is 7.1, indicating a high severity.

To mitigate the risk, users are advised to upgrade to pypdf version 6.21.4 or later, which introduces a page_tree_maximum_page_entries limit to prevent excessive memory usage during page tree flattening. This limit is set to 2,000,000 by default, but can be adjusted in memory-constrained environments. Application developers should also catch and handle pypdf.errors.LimitReachedError and pypdf.errors.PdfReadError exceptions in their code when parsing untrusted PDF streams.

To further reduce the risk, operating system and container memory limits, such as RLIMIT_AS and memory cgroups, can be enforced for PDF parsing tasks. Isolating these tasks in dedicated worker processes with strict memory limits and execution timeouts can also help prevent potential exploits.