CVE-2026-119206: pypdf has possible long runtimes when retrieving page labels
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4251.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The pagelabels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.3 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.3
Event History
Frequently Asked Questions
What application behavior is required for exploitation?
The affected application must retrieve the PDF's page labels through pypdf. Merely handling a crafted PDF is not described as sufficient; the excessive runtime occurs when the page_labels property is accessed.
Which PDF inputs are designed to trigger the slowdown?
A crafted PDF with a flat page-label number tree containing many ranges triggers the issue. Before 6.21.3, pypdf repeatedly scans the /Nums array from the beginning while resolving labels for each page, making processing time grow with both page count and label-range count.
What should be done if an upgrade cannot be applied immediately?
Apply the changes from PR #4251 as a workaround. The issue is fixed in pypdf 6.21.3.