CVE-2026-102993: pypdf Large Memory Consumption Vulnerability Due to Roman Page Labels
Summary
CVE-2026-102993: pypdf: Possible large memory usage when retrieving Roman page labels. Affects pypdf versions < 6.17.0. Fixed in 6.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a popular Python library used for manipulating PDF files. It allows users to create, modify, and extract information from PDF documents. The library is widely utilized in various applications for its ease of use and robust functionality. However, it has a vulnerability that can lead to excessive memory usage when handling documents with large Roman numeral page labels, potentially impacting application performance and stability.
Vulnerability Detail
The vulnerability arises when an attacker crafts a PDF document containing large Roman numerals as page labels. When the pypdf library processes such a document, it can lead to significant memory consumption, which may result in application crashes or degraded performance. This issue is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits), indicating a serious risk to applications that utilize this library.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.17.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade the pypdf package immediately, you can apply the changes from pull request #4047. This involves manually modifying the library's code to mitigate the memory consumption issue until an upgrade can be performed.
Conclusion
The pypdf library has a vulnerability (CVE-2026-102993) that can lead to large memory consumption when processing certain PDF documents. Users are advised to upgrade to version 6.17.0 or later to mitigate this issue. For those unable to upgrade immediately, a temporary workaround is available. Regular monitoring for vulnerabilities is essential, and tools like Vulert can assist in this process.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-102993 is a vulnerability in the pypdf library that can lead to large memory consumption when processing PDF documents with large Roman numeral page labels.
If your application uses pypdf to handle PDF files with large Roman numerals, it may experience excessive memory usage, potentially leading to crashes or performance issues.
You can apply the changes from pull request #4047 as a temporary workaround until you are able to upgrade to the patched version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
