{"id":"CVE-2026-119206","kind":"vulnerability","aliases":["CVE-2026-119206"],"related":[],"title":"pypdf: crafted PDF page labels cause excessive processing time","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.","summary":"pypdf, a Python library for reading PDF files, can take excessive time to retrieve page labels from a crafted PDF with a flat page-label number tree containing many ranges. An attacker who supplies such a file can tie up a process that parses it, causing slowdown or denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","package","pypdf","python"],"not_affected_if":["page-labels-unused","trusted-input-only"],"how_to_check":"- Check the installed pypdf version with `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"`.\n- Find code that reads the `page_labels` property on untrusted PDF input.","fix":"- pypdf: upgrade to `6.21.3`.","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:38+00:00","updated_at":"2026-10-29T21:28:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:38Z","model":"claude-haiku-5-5","output":{"fix":"- pypdf: upgrade to `6.21.3`.","reach":"unknown","title":"pypdf: crafted PDF page labels cause excessive processing time","impact":"low","summary":"pypdf, a Python library for reading PDF files, can take excessive time to retrieve page labels from a crafted PDF with a flat page-label number tree containing many ranges. An attacker who supplies such a file can tie up a process that parses it, causing slowdown or denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf","document-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Denial of service through long processing of a crafted PDF","analyst_note":"","how_to_check":"- Check the installed pypdf version with `pip show pypdf` or `python -c \"import pypdf; print(pypdf.__version__)\"`.\n- Find code that reads the `page_labels` property on untrusted PDF input.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","page-labels-unused"],"who_is_affected":"Applications that use pypdf to parse PDF files from users or other untrusted sources, and call the page_labels property, are exposed. Projects that only process their own trusted PDFs, or never read page labels, can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4150,"output_tokens":502,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119206':12A,15A '-2026':11A,14A '/nums':127C '6.21.3':89C,153C 'array':128C 'attack':54B 'begin':131C 'caus':6A,68B,132C 'contain':50B,103C 'count':140C 'craft':2A,40B,101C 'cve':10A,13A 'denial':71B 'document':17B 'document-process':16B 'excess':7A,32B,93C 'file':29B,59B 'fix':150C 'flat':44B,105C 'free':77C 'grow':135C 'independ':121C 'issu':148C 'label':5A,37B,47B,98C,108C,116C,145C 'librari':25B,86C 'mani':51B,112C 'number':48B,109C,143C 'open':80C 'open-sourc':79C 'packag':19B 'page':4A,36B,46B,97C,107C,115C,120C,139C 'page-label':45B,106C 'pars':66B 'pdf':3A,28B,41B,85C,102C 'prior':87C 'process':8A,18B,64B 'properti':117C 'pure':83C 'pure-python':82C 'pypdf':1A,20B,22B,74C,90C 'python':21B,24B,84C 'rang':52B,113C,146C 'read':27B 'repeat':123C 'resolv':118C 'retriev':35B,96C 'scan':124C 'servic':73B 'slowdown':69B 'sourc':81C 'suppli':56B 'take':31B,92C 'tie':61B 'time':9A,33B,94C 'tree':49B,110C 'version':152C 'work':133C","nicknames":[],"mitigations":[],"who_affected":"Applications that use pypdf to parse PDF files from users or other untrusted sources, and call the page_labels property, are exposed. Projects that only process their own trusted PDFs, or never read page labels, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119206","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}