Package vulnerability, severity high

pypdf has possible large memory usage for exceptions in strict mode

Published October 30, 2026, updated October 31, 2026

pypdf has possible large memory usage for exceptions in strict mode. Source: GHSA-4vqv-7265-gm2w (CVE-2026-119207).

What's affected

• pypdf (pypi)<6.21.3

What to do

1. Upgrade pypdf to 6.21.3 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-4vqv-7265-gm2w

References

• https://osv.dev/vulnerability/GHSA-4vqv-7265-gm2w
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
• https://nvd.nist.gov/vuln/detail/CVE-2026-119207
• https://github.com/py-pdf/pypdf/pull/4265
• https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.21.3

Notice ghsa-4vqv-7265-gm2w, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.