pypdf 6.21.3 / 6.21.4 fix multiple denial-of-service bugs (infinite loops and huge memory use on crafted PDFs: CVE-2026-119203 to -119209). How do I protect a service that processes uploaded PDFs?

What it is: pypdf is the most widely used pure-Python PDF library (reading, splitting, merging, text extraction), common in document pipelines and RAG/LLM ingestion. On October 30, 2026 the project published seven high advisories: crafted or truncated PDFs can trigger infinite loops (trailer search at end of file, dictionary cloning) or very large memory use and long runtimes (page tree parsing, cross-reference streams, page labels, encrypted files, exceptions in strict mode). Some are fixed in 6.21.3 and the rest in 6.21.4. Am I affected: - pypdf below 6.21.4 (pip show pypdf). The older PyPDF2 package is unmaintained and should be replaced with pypdf. - Real risk if you open PDFs from users, email, web crawls or other untrusted sources: one file can hang a worker or exhaust memory. Fix: 1. Upgrade to pypdf 6.21.4 or later and redeploy. 2. Process untrusted PDFs defensively regardless of version: run parsing in a separate worker process with a time limit and a memory limit (container limits, resource.setrlimit, or a task-queue timeout), and limit upload sizes and page counts. 3. If you can't upgrade at once, the advisories point to the specific fix pull requests you can apply as patches. Verify: pip show pypdf reports 6.21.4+, and your PDF workers have timeouts and memory limits that kill a stuck job without taking down the service. Sources: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5 https://github.com/py-pdf/pypdf/releases/tag/6.21.4 https://github.com/advisories/GHSA-5849-834g-hvw5