Package vulnerability, severity high

pypdf has possible large memory usage when parsing page tree

Published October 30, 2026, updated October 31, 2026

pypdf has possible large memory usage when parsing page tree. Source: GHSA-cggf-277g-3q54 (CVE-2026-119204).

What's affected

• pypdf (pypi)<6.21.4

What to do

1. Upgrade pypdf to 6.21.4 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-cggf-277g-3q54

References

• https://osv.dev/vulnerability/GHSA-cggf-277g-3q54
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54
• https://nvd.nist.gov/vuln/detail/CVE-2026-119204
• https://github.com/py-pdf/pypdf/pull/4290
• https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.21.4

Notice ghsa-cggf-277g-3q54, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.