The vulnerability arises when pypdf parses a PDF document whose page tree contains a large number of shared resources. During page‑tree flattening, pypdf copies page dictionaries and inherited resource entries without imposing a document‑wide allocation budget, which enables a crafted PDF to trigger disproportionate memory allocations. The resulting memory exhaustion can cause the process that is parsing the PDF to hang or crash, effectively denying service to the application that relies on pypdf. This flaw is associated with input validation weakness, CWE‑400.

Affected product: py‑pdf pypdf before version 6.21.4. Versions prior to the 6.21.4 release lack the mitigations that bound resource usage during page‑tree processing.

The CVSS score of 7.1 indicates a medium‑to‑high severity. EPSS data is not available, so the probability of exploitation cannot be quantified from that metric. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by delivering a carefully crafted PDF to any application that uses pypdf to parse the file. The likely attack vector is local – a developer or user opens a malicious PDF – but can also be leveraged remotely if the PDF is processed by a web service or API that uses pypdf. The lack of a publication of a public exploit suggests the risk is moderate, but the deterministic nature of the memory exhaustion makes it a viable denial‑of‑service vector.