{
  "id": 17329927,
  "title": "CVE-2026-119204: CVE-2026-119204: Uncontrolled Resource Consumption in pypdf Page Tree Flattening",
  "url": "https://urgent.news/2026/10/31/cve-2026-119204-cve-2026-119204-uncontrolled-resource-consumption-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T03:30:50.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-119204-cve-2026-119204-uncontrolled-resource-consumption-in-pypdf-page-tree-flattening-4p48"
  },
  "original_language": "en",
  "account": "CVE-2026-119204 is a Denial of Service vulnerability affecting earlier versions of the pypdf library, specifically those before version 6.21.4. The issue arises from an uncontrolled resource consumption (CWE-400) during the flattening of a PDF document's page tree. By supplying a specially crafted PDF file with a hierarchical amplification structure of shared /Pages and /Page nodes, an attacker can cause pypdf to consume excessive memory, leading to a heap memory exhaustion and potential process termination.\n\nThe vulnerability is due to the lack of a global budget for copied dictionary entries when flattening the page tree. By referencing shared page nodes multiple times, an attacker can trigger an exponential increase in memory allocation, ultimately resulting in a denial of service. The CVSS score for this vulnerability is 7.1, indicating a high severity.\n\nTo mitigate the risk, users are advised to upgrade to pypdf version 6.21.4 or later, which introduces a page_tree_maximum_page_entries limit to prevent excessive memory usage during page tree flattening. This limit is set to 2,000,000 by default, but can be adjusted in memory-constrained environments. Application developers should also catch and handle pypdf.errors.LimitReachedError and pypdf.errors.PdfReadError exceptions in their code when parsing untrusted PDF streams.\n\nTo further reduce the risk, operating system and container memory limits, such as RLIMIT_AS and memory cgroups, can be enforced for PDF parsing tasks. Isolating these tasks in dedicated worker processes with strict memory limits and execution timeouts can also help prevent potential exploits.",
  "summary": "CVE-2026-119204: Uncontrolled Resource Consumption in pypdf Page Tree Flattening Vulnerability ID: CVE-2026-119204 CVSS Score: 7.1 Published: 2026-10-30 CVE-2026-119204 (also tracked as GHSA-cggf-277g-3q54) is a Denial of Service (DoS) vulnerability in pypdf prior to version 6.21.4. The vulnerability stems from uncontrolled resource consumption (CWE-400) during the flattening of a PDF document's…",
  "key_points": [
    "CVE-2026-119204 affects pypdf versions before 6.21.4",
    "Uncontrolled resource consumption in page tree flattening",
    "Upgrade to version 6.21.4 or later to mitigate"
  ],
  "editors_take": "The vulnerability exposes developers using older versions of the pypdf library to denial of service attacks through memory exhaustion triggered by maliciously crafted PDF structures.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}