pypdf is a pure‑Python PDF library that, before version 6.21.0, allows an attacker to craft a PDF containing a large or specially arranged form. When an application imports pypdf and calls the form‑field retrieval routine, the library can consume excessive memory or run for an extended period, leading to temporary denial of service by exhausting system resources. The weakness is aligned with resource‑exhaustion (CWE‑400), inefficient loop processing (CWE‑407), and long‑running operations that exceed memory limits (CWE‑770).

The issue affects all deployments of the py‑pdf pypdf package that are older than 6.21.0. Any application that imports pypdf and invokes form‑field extraction is potentially exposed; no other vendors or product families are listed as affected.

The CVSS score of 6 indicates moderate severity, but the EPSS score of < 1% shows that real‑world exploitation is considered unlikely. The vulnerability is not listed in CISA KEV. The likely attack vector is the delivery of a malicious PDF to a target application that processes PDFs, such as a web service or desktop utility that accepts user‑supplied files. Upon processing, the application may become unresponsive or crash due to the extreme memory usage or prolonged runtime.