Vulnerability GHSA-42gh-23hr-vphw
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 hours ago
October 30, 2026 at 11:08 PM UTC
pypdf has possible long runtimes when retrieving page labels
1.0 - 6.21.2
1.0 - 6.21.2
Summary
pypdf has possible long runtimes when retrieving page labels
Details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.
Patches
This has been fixed in pypdf==6.21.3.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4251.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
1.0 - 6.21.3 GHSA-5849-834g-hvw5
1.0 - 6.21.3 GHSA-5849-834g-hvw5
High Risk
4 hours ago
pypdf has possible large memory usage when parsing page tree
1.0 - 6.21.3 GHSA-cggf-277g-3q54
1.0 - 6.21.3 GHSA-cggf-277g-3q54
High Risk
4 hours ago
pypdf has possible infinite loop when cloning dictionaries
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
1.0 - 6.21.3 GHSA-mfr5-77xh-9j7h
High Risk
4 hours ago
pypdf has possible large memory usage for exceptions in strict mode
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
1.0 - 6.21.2 GHSA-4vqv-7265-gm2w
High Risk
4 hours ago
pypdf has possible long runtimes/large memory usage for encrypted PDF files
1.0 - 6.21.2 GHSA-62m5-6wh8-28x7
1.0 - 6.21.2 GHSA-62m5-6wh8-28x7
Impacted packages
Timeline
Published
4 hours ago
October 30, 2026 at 11:08 PM UTC
Fixed (6.21.3)
3 days ago
October 27, 2026 at 12:16 PM UTC
Last Modified
4 hours ago
October 30, 2026 at 11:15 PM UTC