Bug 2563678 (CVE-2026-119206) - CVE-2026-119206 pypdf: pypdf: Denial of Service via crafted PDF page labels
Summary: CVE-2026-119206 pypdf: pypdf: Denial of Service via crafted PDF page labels
Keywords:
Status: NEW
Alias: CVE-2026-119206
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-29 20:53 UTC by OSIDB Bzimport
Modified: 2026-10-29 21:06 UTC (History)
23 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-29 20:53:14 UTC 
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.
Note You need to log in before you can comment on or make changes to this bug.