A flaw in the pypdf library causes the page_labels property to scan the /Nums array repeatedly for each page, resulting in quadratic growth of processing time when a PDF contains many label ranges. This can cause an attacker to trigger long runtimes and exhaustion of CPU resources, meeting the definition of uncontrolled resource consumption (CWE-400). The consequence is a denial of service that impacts availability of any service that loads malformed PDFs.

The vulnerability affects the py-pdf:pypdf library in any application using a version prior to 6.21.3. It applies to programs written in Python that import pypdf to read or modify PDF files, regardless of operating system.

With a CVSS score of 7.1 the flaw is considered moderate severity. No EPSS value is available, so the current exploitation probability cannot be quantified, but the fact that the issue can be triggered by a crafted PDF suggests that any system that processes PDFs from untrusted sources is at risk. The vulnerability is not listed in the CISA KEV catalog. An attacker can supply a PDF with many label ranges to abuse the algorithmic inefficiency and induce a DoS.