pypdf, a pure‑Python PDF library, can consume excessive CPU time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. After decryption, the library trusts the declared count instead of validating it by walking the page tree, allowing an attacker‑controlled value to drive arbitrarily large processing. This behaviour constitutes a resource exhaustion flaw.

The vulnerability affects the py-pdf:pypdf library in all releases prior to 6.21.3. The fix was introduced in version 6.21.3; any downstream use of older versions is vulnerable.

The vulnerability carries a CVSS score of 7.1, indicating moderate‑to‑high severity, and it is not listed in the CISA KEV catalog. EPSS data is not available. The attack requires a crafted encrypted PDF file; the likely vector is an application that loads or processes a PDF from a user or network source and then requests the page count. Once the file is decrypted, the forged /Count value causes the library to perform excessive work, potentially exhausting memory or CPU and denying service to the application or host.