CVE-2026-119206

— UNSCOREDpublic exploit available

Published 2026-10-29 · Updated 2026-10-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.

Weaknesses

CWE-400

Public exploit & PoC references

https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e
https://github.com/py-pdf/pypdf/pull/4251
https://github.com/py-pdf/pypdf/releases/tag/6.21.3
https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw

All references

https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e
https://github.com/py-pdf/pypdf/pull/4251
https://github.com/py-pdf/pypdf/releases/tag/6.21.3
https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2025-52290
HIGHCVE-2026-100137
HIGHCVE-2026-100138
HIGHCVE-2026-100139
HIGHCVE-2026-100242PoC
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100527PoC
LOWCVE-2026-100542PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.