GHSA-42gh-23hr-vphw: pypdf has possible long runtimes when retrieving page labels

Severity: HIGH
CVE: CVE-2026-119206
Ecosystems: pip
Packages: pypdf

Written by

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

### Patches

This has been fixed in [pypdf==6.21.3](https://github.com/py-pdf/pypdf/releases/tag/6.21.3).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4251](https://github.com/py-pdf/pypdf/pull/4251).

More posts