CVE-2026-28804

pypdf prior to 6.21.3 can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply parsed entries, while negative /Index counts bypass the existing per-stream clamp.

pypdf prior to 6.21.3 can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree.

pypdf prior to 6.21.3 can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages.

pypdf prior to 6.21.3 can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning.

pypdf prior to 6.21.4 can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check.

pypdf prior to 6.21.4 can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, causing disproportionate allocations.

pypdf before version 6.21.4 can enter an infinite loop when opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating, blocking the processing thread.

In pypdf prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

In pypdf prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

pypdf before version 6.21.2 is vulnerable to an attack where a crafted PDF repeatedly references the same nonexistent indirect object. This triggers repeated full-file recovery loads and long runtimes when accessing parts such as pages. The issue is fixed in version 6.21.2.