pypdf is a free, pure‑Python PDF library. An attacker can craft a PDF that contains repeated malformed cross‑reference streams, forcing pypdf to spend an extended amount of time attempting to recover broken cross‑reference table entries. This uncontrolled resource consumption can lead to a denial of service by exhausting CPU time or memory. The flaw is classified as CWE‑400 and CWE‑1050, representing uncontrolled resource consumption and an uninitialized variable usage weakness.

The vulnerability affects all releases of the py‑pdf:pypdf library prior to that parses PDFs using pypdf—such as web services, document conversion tools, or arbitrary Python code that imports the library—is potentially impacted.

The CVSS score of 6.9 indicates moderate severity. Exploitation requires the attacker to supply a malicious PDF to the vulnerable library, which may be possible in externally exposed services that accept PDF input. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. This flaw, which involves CWE‑1050 and CWE‑400, is associated with resource exhaustion and potential uninitialized variable usage. The likely attack vector is supplying a malicious PDF via an externally exposed service that accepts PDF input; this is inferred from the description, as the vulnerability only manifests when pypdf processes a crafted PDF. Nonetheless, the DoS impact could severely rely on pypdf, making the risk significant if other controls are not in place.