OSV security advisory
Security advisory for pypdf
GHSA-42gh-23hr-vphw
Full advisory details, affected packages, severity context, and original source.
Affected technology
pypdfAffected product
Advisory overview
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file. ### Patches This has been fixed in [pypdf==6.21.3](https://github.com/py-pdf/pypdf/releases/tag/6.21.3). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4251](https://github.com/py-pdf/pypdf/pull/4251).
Affected packages and releases
PyPI / pypdf
1.0, 1.1, 1.10, 1.11, 1.12, 1.13, 1.2, 1.3
Also known as
CVE-2026-119206