CVE-2026-113792: pypdf: Possible infinite loop in PdfWriter.find_outline_item

Q: Who is exposed to this issue?

Applications using pypdf versions before 6.20.1 are exposed if they call PdfWriter.find_outline_item on attacker-controlled or otherwise crafted PDFs.

Q: What does an attacker need to exploit it?

The attacker needs to provide a PDF with a cyclic outline hierarchy and cause the application to call PdfWriter.find_outline_item on it. Successful exploitation can make the current process loop indefinitely.

Q: Is there a workaround if upgrading is not immediately possible?

Apply the changes from PR #4188. The issue is fixed by upgrading pypdf to version 6.20.1.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling findoutlineitem on a PdfWriter.

Patches

This has been fixed in pypdf==6.20.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4188.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.findoutlineitem on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.20.1

pip/pypdf<6.20.1

6.20.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Compensating control
If you cannot upgrade to pypdf 6.20.1, apply the changes from PR #4188.

Event History

Oct 21, 2026

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

DescriptionWeakness

Advisory Published

via GitHub·04:55 PM

Data Sourced

via GitHub·04:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using pypdf versions before 6.20.1 are exposed if they call PdfWriter.find_outline_item on attacker-controlled or otherwise crafted PDFs.

What does an attacker need to exploit it?

The attacker needs to provide a PDF with a cyclic outline hierarchy and cause the application to call PdfWriter.find_outline_item on it. Successful exploitation can make the current process loop indefinitely.

Is there a workaround if upgrading is not immediately possible?

Apply the changes from PR #4188. The issue is fixed by upgrading pypdf to version 6.20.1.

CVE-2026-113792: pypdf: Possible infinite loop in PdfWriter.find_outline_item

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is there a workaround if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is there a workaround if upgrading is not immediately possible?