pypdf: Uncontrolled resource consumption via alphabetical page labels
Summary
pypdf, a pure-Python library for reading and processing PDF files, does not limit the length of alphabetical page labels. A crafted PDF with unusually large alphabetical label values can make the application generate very long label strings when page labels are read, which consumes excessive memory. An attacker who can supply a PDF to an application that reads page labels can therefore make that application slow or unavailable; confidentiality and integrity are not affected.
Affected
- pypdf versions before 6.19.0
Fixed in
- pypdf 6.19.0 (fix from commit 0d8b5a8; newer releases are available and should be preferred)
Workaround
- If an upgrade is not possible yet, apply the changes from PR #4096 to the pypdf source code.
- Limit memory and runtime for PDF processing workers and restrict which services accept untrusted PDFs (suggestion, not from the vendor).
Exploitation
- No known exploitation at the time of analysis. The CISA SSVC assessment lists exploitation as 'none', automatable as 'yes' and technical impact as 'partial'.
- No public exploit code has been found in the sources reviewed; this is not proof that none exists.
- Not verified against the CISA KEV catalogue; check before closing the ticket.
Our recommendation
- Inventory all pypdf installations, including requirements files, containers and bundled tools; pypdf is often a transitive dependency.
- Upgrade to pypdf 6.19.0 at minimum, preferably the latest available release.
- Where pypdf processes untrusted PDFs, enforce memory and timeout limits on the worker process.
- Prioritise internet-facing services that accept PDF uploads (for example document management, scanning or mail gateways).
- Note that the GitHub advisory rates this as Moderate, while the CVSS v4.0 score in NVD is 8.7 (High); use the NVD score for internal records.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w23x-9jrw-r45c github.com
- Fix commit 0d8b5a8: Limit size of alphabetical page labels github.com
- Pull request #4096 github.com
- pypdf release 6.19.0 github.com
- OSV entry GHSA-w23x-9jrw-r45c osv.dev
- GitLab Advisory CVE-2026-103000 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:27.
Original description (NVD)
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.