Disclosure summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
Source-reported weakness categories
CWE-400, CWE-770
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-102993
Open original source · Updated Oct 02, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| pypdf_project | pypdf | * {"versionEndExcluding":"6.17.0"} |
GitHub Reviewed Security Advisories · GHSA-qv6h-rv94-w285
Open original source · Updated Oct 01, 2026
pypdf: Possible large memory usage when retrieving Roman page labels
Source severity: HIGH / 8.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pypdf | < 6.17.0 | 6.17.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch
- github.com — Release Notes
- github.com — Patch, Vendor Advisory
PUBLISHED 2026-09-30T16:17:27-04:00
MODIFIED 2026-10-02T13:17:01-04:00
INGESTED 2026-10-06T11:44:59-04:00