CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4251.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

Patches

This has been fixed in pypdf==6.21.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4251.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

This update for python-pypdf fixes the following issues:

Changes in python-pypdf:

• CVE-2026-119209: negative /Index values and multiplied xref streams can lead to clamp bypass and server memory exhaustion (bsc#1288950)
• CVE-2026-119208: trusting forged /Count values in encrypted PDF page trees can lead to excessive resource consumption and denial of service (bsc#1288951)
• CVE-2026-119207: nested exception text accumulation in strict mode parsing can lead to memory amplification and application denial of service (bsc#1288952)
• CVE-2026-119206: repeated sequential /Nums scanning in page_labels resolution can lead to algorithmic complexity attacks and denial of service (bsc#1288944)
• CVE-2026-119205: misdirected reference tracking during dictionary cloning can lead to cycle-detection bypass and thread-hanging infinite loops (bsc#1288943)
• CVE-2026-119204: unbounded resource entry copying during page-tree flattening can lead to excessive memory allocation and denial of service (bsc#1288942)
• CVE-2026-119203: unterminated trailer search in incomplete cross-reference tables can lead to an infinite loop and thread-blocking denial of service (bsc#1288941)