CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels

October 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.

References

github.com/advisories/GHSA-qv6h-rv94-w285
github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163
github.com/py-pdf/pypdf/pull/4047
github.com/py-pdf/pypdf/releases/tag/6.17.0
github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285
nvd.nist.gov/vuln/detail/CVE-2026-102993

Code Behaviors & Features

Detect and mitigate CVE-2026-102993 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →