Denial of Service in pypdf PDF Library by PyPDF Technologies

CVE-2026-119206

What is CVE-2026-119206?

The pypdf library, a widely used open-source Python PDF library, has a vulnerability that can lead to a Denial of Service condition. Versions before 6.21.3 are affected, where the library can take excessive time to retrieve page labels from specially crafted PDFs containing a complex flat page-label number tree. The inefficiency arises from the page_labels property resolving each page independently, leading to repeated scans of the same /Nums array. As the number of pages and label ranges increases, so too does the resource consumption, potentially halting normal operations. This issue has been remedied in version 6.21.3.

References