SB2026110374 - Multiple vulnerabilities in PyPDF

Description

This security bulletin contains information about 3 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2026-119206)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause excessive processing times and potentially a denial of service.

The vulnerability exists due to uncontrolled resource consumption in pypdf's page label retrieval functionality when retrieving page labels from a crafted PDF file. A remote attacker can supply a specially crafted PDF file to cause prolonged processing and potentially a denial of service when its page labels are retrieved.

2) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-119207)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause excessive memory consumption, potentially resulting in a denial of service.

The vulnerability exists due to uncontrolled resource consumption in pypdf's strict-mode exception handling when loading an invalid PDF dictionary. A remote attacker can craft a PDF containing an invalid dictionary to trigger large memory usage and potentially exhaust available memory.

3) Resource exhaustion (CVE-ID: CVE-2026-119208)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through excessive processing time or memory consumption.

The vulnerability exists due to uncontrolled resource consumption in pypdf's page-count handling when accessing the page count of an encrypted PDF file with an incorrect /Count value. A remote attacker can supply a specially crafted encrypted PDF file to trigger excessive processing time or memory consumption and cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7