CVE-2026-119206: pypdf: Possible long runtimes when retrieving page labels — Fixed versions

Summary

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

Remediation

Inventory every py-pdf pypdf deployment, including staging.
Upgrade py-pdf pypdf to 6.21.3.
Confirm the running version after the upgrade.

References

Patchhttps://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
Patchhttps://github.com/py-pdf/pypdf/pull/4251
Patchhttps://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e
Advisoryhttps://github.com/advisories/GHSA-42gh-23hr-vphw
Referencehttps://github.com/py-pdf/pypdf/releases/tag/6.21.3
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-119206

Version	Fixed in
< 6.21.3	6.21.3
– <6.21.3	6.21.3