pypdf has possible long runtimes when retrieving page labels

HIGHCVE-2026-119206 · GHSA-42gh-23hr-vphw · Published 30/10/2026 · updated 30/10/2026

In short

CVE-2026-119206 is a HIGH vulnerability affecting pypdf.
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 23.2% of all vulnerabilities.
Fix: update to 6.21.3 or later.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.3`	`6.21.3`

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

This has been fixed in pypdf==6.21.3.

If you cannot upgrade yet, consider applying the changes from PR #4251.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.