CVE-2026-119206: CVE-2026-119206: Algorithmic Complexity Denial of Service in pypdf Page Label Resolution

Two vulnerabilities, CVE-2026-119206 and CVE-2026-119207, affect pypdf versions prior to 6.21.3. CVE-2026-119206 involves an algorithmic complexity issue in page_labels resolution, where quadratic scaling of CPU resource consumption occurs during linear scans of the /PageLabels number tree. Meanwhile, CVE-2026-119207 is an asymmetric resource consumption flaw in the DictionaryObject.read_from_stream method. It fails to bound exception message lengths when parsing malformed, unclosed dictionary structures in strict mode, potentially leading to a denial-of-service (DoS) condition.