pypdf allows an attacker to craft a PDF containing a large or cleverly structured form that triggers extremely high memory consumption or protracted processing time when an application calls the library’s form‑field extraction routine. The result is temporary denial of service for the process using the library, as system resources can be exhausted or the application can become unresponsive. The weaknesses align with resource‑exhaustion classes, reflected in the CWE designations.

The vulnerability affects all deployments of the py‑pdf pypdf package that are older than version 6.21.0. Any application importing pypdf and invoking form‑field retrieval capabilities is potentially exposed. No other vendors or product families are listed as affected.

The CVSS score of 6 indicates moderate severity. The vulnerability is not listed in CISA KEV. Attackers would need to deliver the crafted PDF to the target application, which is usually possible in web services or desktop processing utilities that accept user‑supplied PDFs. Once the PDF is processed, the memory or time drain can cause local resource exhaustion, leading to application slowdown or crash without additional privileges.