CVE-2026-102993: py-pdf pypdf Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-102993 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in py-pdf pypdf. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities.
Timeline
- 30-09-2026PublishedVulnerability first disclosed.
- 02-10-2026Last modifiedVulnerability information updated.
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Ubuntu2 products
- pypdfAll versions (No fix recorded)
- pypdf2All versions (No fix recorded)
Chainguard1 product
- open-webui< 0.11.4-r3
Debian1 product
- pypdfAll versions (No fix recorded) | < 6.19.0-1
Py-pdf1 product
- pypdf< 6.17.0
Pypdf_project1 product
- pypdf< 6.17.0
PyPI1 product
- pypdf< 6.17.0
Wolfi1 product
- open-webui< 0.11.4-r3
7 vendors · 8 products
References
11 links- github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285X Refsource CONFIRMWEBREPORTPatchVendor Advisory
- github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163X Refsource MISCWEBREPORTPatch
- github.com/py-pdf/pypdfPACKAGE
- pypi.org/project/pypdfPACKAGE
