CVE-2026-103000 is a High severity denial of service in pypdf. Before version 6.19.0, a crafted PDF can give unusually large alphabetical page label values and make the library build strings far beyond a reasonable length. Upgrade to 6.19.0 or later to fix it.
What's affected
- Package: pypdf (pip).
- Affected: all versions before 6.19.0, per the project advisory.
- Fixed: 6.19.0, released 16 September 2026 according to the release page.
- Trigger: retrieving page labels from a document that uses large alphabetical label values.
The record gives a CVSS score of 7.5 and a severity of High. The project's own GitHub advisory labels this issue Moderate. Both are shown here. Treat the score as a prioritisation input and judge the real impact by whether untrusted PDFs reach your parser.
How to check if you're exposed
pypdf is a Python package, so start with the version installed in each environment that handles PDFs.
pip show pypdf
pip freeze | grep -i pypdf
grep -ri "pypdf" requirements*.txt pyproject.toml poetry.lock uv.lock Pipfile.lock 2>/dev/null
Check every place a PDF is parsed: web upload handlers, background workers, document pipelines and notebooks. Containers matter too, because an old image can pin an old pypdf long after the source repository moved on. Also look at transitive installs. Another library may pull pypdf in without listing it in your own requirements file.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Upgrade pypdf to 6.19.0 or later in every environment that parses PDFs. Version 6.19.0 or later covers every pypdf advisory in this series of posts.
- Run your PDF test suite after the upgrade. Test page label output on a document that uses letter based numbering.
- Rebuild container images and redeploy so old layers do not keep the vulnerable package.
- Put limits around PDF handling in the meantime: file size caps, a time limit per job, and a memory limit on the worker, so one bad file cannot take the service down.
- Re-scan your lockfiles after the change to confirm no second copy of pypdf remains.
Why it matters
This is the alphabetical twin of the Roman numeral issue fixed in 6.17.0, and it is classed as CWE-400. Page labels can number pages with letters, and the code repeats the letter when a count passes Z. If the count in the file is huge, so is the string.
The release notes say the fix limits the size of alphabetical page labels. The 6.18.1 notes also mention repeating the letter for these label styles past Z, so this area has changed more than once in a short window.
As with the Roman numeral case, only code that reads page labels is in the path. The record does not list this CVE as exploited in the wild, so use it to prioritise, not to panic.
Quick check
How is this different from CVE-2026-102993?
That one covers large Roman numeral labels and is fixed in 6.17.0. This one covers alphabetical labels and is fixed in 6.19.0.
Where was it fixed?
In pypdf 6.19.0, in a change that limits the size of alphabetical page labels, per the release notes.
Sources
Last reviewed: 18 October 2026.
