CVE-2026-103000: pypdf: Possible large memory usage when retrieving alphabetical page labels

October 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels.

References

github.com/advisories/GHSA-w23x-9jrw-r45c
github.com/py-pdf/pypdf/commit/0d8b5a8832cde1ba308b5c27567b879b7b7eed4a
github.com/py-pdf/pypdf/pull/4096
github.com/py-pdf/pypdf/releases/tag/6.19.0
github.com/py-pdf/pypdf/security/advisories/GHSA-w23x-9jrw-r45c
nvd.nist.gov/vuln/detail/CVE-2026-103000

Code Behaviors & Features

Detect and mitigate CVE-2026-103000 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →