Package vulnerability, severity high

pypdf has possible long runtimes when retrieving page labels

Published October 30, 2026, updated October 31, 2026

pypdf has possible long runtimes when retrieving page labels. Source: GHSA-42gh-23hr-vphw (CVE-2026-119206).

What's affected

• pypdf (pypi)<6.21.3

What to do

1. Upgrade pypdf to 6.21.3 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-42gh-23hr-vphw

References

• https://osv.dev/vulnerability/GHSA-42gh-23hr-vphw
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
• https://nvd.nist.gov/vuln/detail/CVE-2026-119206
• https://github.com/py-pdf/pypdf/pull/4251
• https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.21.3

Notice ghsa-42gh-23hr-vphw, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.