Live › vulnerability › CVE-2026-119206
pypdf, a Python library for reading PDF files, can take excessive time to retrieve page labels from a crafted PDF with a flat page-label number tree containing many ranges. An attacker who supplies such a file can tie up a process that parses it, causing slowdown or denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications that use pypdf to parse PDF files from users or other untrusted sources, and call the page_labels property, are exposed. Projects that only process their own trusted PDFs, or never read page labels, can skip it.
No product ranges from the sources yet.
pip show pypdf or python -c "import pypdf; print(pypdf.__version__)".page_labels property on untrusted PDF input.6.21.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119206")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.