CVE-2026-102993
published 2026-09-30CVE-2026-102993: pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.35%
27.4th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform | automation-orchestrator-backend-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.17.0 | 6.17.0 |
| pypdf_project | pypdf | < 6.17.0 | 6.17.0 |
| pypdf_project | pypdf | >= 0 < 6.17.0 | 6.17.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Possible large memory usage when retrieving Roman page labels
ghsa·2026-10-01
CVE-2026-102993 [HIGH] CWE-400 pypdf: Possible large memory usage when retrieving Roman page labels
pypdf: Possible large memory usage when retrieving Roman page labels
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.
### Patches
This has been fixed in [pypdf==6.17.0](https://github.com/py-pdf/pypdf/releases/tag/6.17.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4047](https://github.com/py-pdf/pypdf/pull/4047).
Red Hat
pypdf: pypdf: Denial of Service via crafted Roman page labels
vendor_redhat·2026-09-30·CVSS 8.7
CVE-2026-102993 [HIGH] CWE-770 pypdf: pypdf: Denial of Service via crafted Roman page labels
pypdf: pypdf: Denial of Service via crafted Roman page labels
A flaw was found in pypdf. An attacker can provide a specially crafted PDF document containing unusually large Roman numeral page labels. When an application retrieves these page labels, the library generates excessively large numeral strings, resulting in substantial memory consumption and a potential Denial of Service (DoS).
Package: ansible-automation-platform/automation-orchestrator-backend-rhel9 (Ansible Automation Orchestrator 2026) - Fix deferred
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Core) - Fix deferred
Package: openshift-lightspeed/lig
No detection rules found.
No public exploits indexed.
2026-09-30
Published