pypdf, a pure‑Python PDF library, contains a defect whereby parsing a PDF with a content stream of many tiny operations can cause the parser to allocate excessive memory, potentially exhausting system resources and leading to a denial of service. This vulnerability is associated with uncontrolled resource consumption (CWE‑400) and memory overconsumption (CWE‑770). The impact is a crash or slowdown of any application that utilizes pypdf to handle untrusted PDFs.

Versions of the pypdf library older than 6.21.0 are affected. Any system that imports and uses pypdf to parse user‑supplied PDFs is potentially vulnerable until the library is updated.

The CVSS score of 6 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Although the exploit circumstances are not publicly documented, the likely attack vector involves a local attacker supplying a malicious PDF to an application that employs pypdf, forcing the parser to allocate large amounts of memory and causing a denial of service.