pypdf: Uncontrolled resource consumption via crafted Roman page labels
Summary
pypdf is a pure-Python library for reading and processing PDF files. Before version 6.17.0, a crafted PDF with unusually large Roman page-label values makes pypdf generate excessively large numeral strings when an application reads the page labels. An attacker can exhaust memory and make the processing application unavailable (denial of service). Exploitation requires that the application parses the attacker's PDF and retrieves its page labels.
Affected
- pypdf versions before 6.17.0
- Applications that call pypdf to retrieve page labels from untrusted PDF files
Fixed in
- Upgrade to pypdf 6.17.0 or later (the vendor advisory lists 6.17.0 as the fix; newer releases exist and the latest release is recommended)
Workaround
- If you cannot upgrade yet, the advisory suggests applying the changes from PR #4047 (not verified in detail; a backport needs your own code review).
- Run PDF processing in a sandbox or worker process with memory and CPU limits to contain the impact. This limits the damage but does not fix the flaw.
Exploitation
- No public exploit code or in-the-wild exploitation known at the time of the sources.
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify all Python environments, containers and lock files that include pypdf, including transitive dependencies.
- Upgrade to pypdf 6.17.0 or later, ideally the latest release, and retest document workflows.
- If public or external uploads are processed, prioritise this upgrade and add memory limits to the worker processes now.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qv6h-rv94-w285 github.com
- pypdf release 6.17.0 github.com
- Commit 89db7c4: Limit value for Roman numerals (#4047) github.com
- Pull request #4047 github.com
- OSV GHSA-qv6h-rv94-w285 osv.dev
- pypdf 6.17.0 on PyPI pypi.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:33.
Original description (NVD)
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.