CVE-2026-119208
Description
A flaw was found in pypdf. An attacker can cause a Denial of Service (DoS) by providing a crafted, encrypted PDF document containing a forged page count. When an application attempts to retrieve the page count, pypdf trusts the unvalidated declared value rather than verifying the page tree, resulting in excessive CPU processing time and memory consumption.
Statement
This vulnerability is rated as Moderate severity because exploitation is restricted to denial of service via CPU and memory exhaustion, without allowing arbitrary code execution or data confidentiality loss. In Red Hat environments, such as containerized AI pipelines in OpenShift AI and OpenShift Lightspeed, the library is utilized during document ingestion workflows. Successful exploitation requires an application to parse and query the structural count of a maliciously manipulated encrypted document supplied by an untrusted user. Any disruption remains confined to the individual parsing container or process, limiting broader platform impact.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
