pypdf has possible long runtimes when retrieving page labels

HOCH 7.1CVE-2026-119206 · GHSA-42gh-23hr-vphw · Published 29/10/2026 · updated 30/10/2026

Kurz gesagt

CVE-2026-119206 ist eine Schwachstelle (HOCH (CVSS 7.1)) in pypdf.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.30%, höher als bei 23.2% aller Schwachstellen.
Abhilfe: auf 6.21.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.3`	`6.21.3`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4251.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.