The pypdf library permits parsing of PDF files. Prior to version 6.21.2, repeated malformed cross‑reference entries could trigger incomplete remediation that forces the library to reload the entire PDF stream on each recovery attempt, even when a recovery cache is present. This results in the parser repeatedly processing large portions of the document, consuming excessive CPU time and leading to very long runtimes. The primary consequence is a denial‑of‑service condition that can stall applications that rely on pypdf to parse normal or user‑supplied PDFs.

Affected systems are any Python applications that import the py‑pdf:pypdf package and use its default parsing routines. All releases prior to 6.21.2 are vulnerable. The issue is fixed in version 6.21.2, which is available from the project’s releases page.

The CVSS score of 7.1 classifies this vulnerability as high. The EPSS score is unavailable, yet the attack would require an adversary to craft a PDF containing repeated malformed cross‑reference entries; the nature of the flaw indicates that the attack vector is the supplied PDF data (based on the description, it is inferred that the supply of a crafted PDF is required). Although the vulnerability is not listed in CISA KEV, the high severity score and the potential for widespread exploitation in any environment that processes untrusted PDFs makes it a significant threat. Therefore, any deployment that parses PDFs from unreliable sources should consider the risk to be substantial.