pypdf Memory Exhaustion Vulnerability

The pypdf library contains a vulnerability, identified as CVE-2026-103000, that exposes applications to a denial-of-service (DoS) condition. The issue resides in the handling of alphabetical page labels within PDF documents. When the library processes a document containing specifically crafted, excessively large alphabetical page labels, it triggers a disproportionate increase in memory usage. This can lead to service instability, resource exhaustion, or application crashes depending on the environment where the library is deployed. This vulnerability affects all versions of pypdf prior to 6.19.0. Organizations using pypdf to process untrusted or user-uploaded PDF files are at risk and should prioritize upgrading to the patched version or applying the recommended code changes.

Impact

Successful exploitation results in a denial-of-service state for the application processing the malicious PDF. This is particularly concerning for document management systems, web scrapers, or any automated pipeline that parses user-provided PDFs. If the host environment has constrained memory, a single crafted file could induce a crash, disrupting service availability.

Recommendation

• Upgrade the pypdf library to version 6.19.0 or later immediately to incorporate the patch for CVE-2026-103000.
• If an immediate upgrade is not possible, apply the code changes provided in the vendor pull request (PR #4096) to sanitize or limit the processing of page labels.
• Implement memory limits (e.g., cgroups, container memory limits) on processes responsible for parsing untrusted PDF files to mitigate the impact of potential resource exhaustion attacks.