Disclosure summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.
Source-reported weakness categories
CWE-400
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-103000
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| pypdf_project | pypdf | * {"versionEndExcluding":"6.19.0"} |
GitHub Reviewed Security Advisories · GHSA-w23x-9jrw-r45c
Open original source · Updated Oct 01, 2026
pypdf: Possible large memory usage when retrieving alphabetical page labels
Source severity: HIGH / 8.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pypdf | < 6.19.0 | 6.19.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch, Issue Tracking
- github.com — Release Notes
- github.com — Vendor Advisory
PUBLISHED 2026-09-30T17:17:07-04:00
MODIFIED 2026-10-05T11:03:11-04:00
INGESTED 2026-10-06T11:44:59-04:00