GHSA-42gh-23hr-vphw: pypdf has possible long runtimes when retrieving page labels

Q: Which applications are exposed to this issue?

Applications using pypdf versions prior to 6.21.3 are exposed when they retrieve the page_labels property for attacker-controlled or otherwise untrusted PDF files. The impact is excessive processing time, potentially affecting availability.

Q: What does an attacker need to do to trigger the problem?

An attacker must provide a crafted PDF containing a flat page-label number tree with many ranges, and the application must retrieve that file's page labels. No attacker privileges are required, but user interaction is required according to the supplied severity vector.

Q: Are default pypdf operations affected?

The issue specifically requires page-label retrieval; the provided information does not indicate that simply opening or processing every PDF triggers it. Risk is greatest in workflows that access page_labels for untrusted PDFs.

Q: What can be done if upgrading is not immediately possible?

Apply the changes from PR #4251 as a workaround. Upgrading pypdf to version 6.21.3 is the stated fix.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4251.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The pagelabels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.3

6.21.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.3
Compensating control
If upgrading is not yet possible, apply the changes from PR #4251.

Event History

Oct 29, 2026

CVE Published

via OSV·08:37 PM

Data Sourced

via OSV·08:37 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:08 PM

Data Sourced

via GitHub·11:08 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:08 PM

Affected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using pypdf versions prior to 6.21.3 are exposed when they retrieve the page_labels property for attacker-controlled or otherwise untrusted PDF files. The impact is excessive processing time, potentially affecting availability.

What does an attacker need to do to trigger the problem?

An attacker must provide a crafted PDF containing a flat page-label number tree with many ranges, and the application must retrieve that file's page labels. No attacker privileges are required, but user interaction is required according to the supplied severity vector.

Are default pypdf operations affected?

The issue specifically requires page-label retrieval; the provided information does not indicate that simply opening or processing every PDF triggers it. Risk is greatest in workflows that access page_labels for untrusted PDFs.

What can be done if upgrading is not immediately possible?

Apply the changes from PR #4251 as a workaround. Upgrading pypdf to version 6.21.3 is the stated fix.

GHSA-42gh-23hr-vphw: pypdf has possible long runtimes when retrieving page labels

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger the problem?

Are default pypdf operations affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger the problem?

Are default pypdf operations affected?

What can be done if upgrading is not immediately possible?