CVE-2026-113793: pypdf: Possible infinite loop when removing tree items

Q: Who is exposed to this issue?

Applications using pypdf versions before 6.20.1 are exposed when they remove objects from PDF tree structures, such as outline items, while processing attacker-crafted PDFs with cyclic trees.

Q: What does an attacker need to do to trigger the issue?

An attacker needs to provide a crafted PDF containing a cyclic tree and cause the application to remove an object from that tree. Successful triggering can cause the current process to loop indefinitely and become blocked.

Q: Is there a mitigation if upgrading is not immediately possible?

Apply the changes from PR #4188 as a workaround. The permanent fix is to upgrade pypdf to version 6.20.1.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.

Patches

This has been fixed in pypdf==6.20.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4188.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

— MITRE

Affected Software

2 affected componentsFixes available

pypi/pypdf<6.20.1

pip/pypdf<6.20.1

6.20.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Compensating control
If upgrading is not yet possible, apply the changes from PR #4188.

Event History

Oct 21, 2026

CVE Published

via MITRE·03:57 PM

Data Sourced

via MITRE·03:57 PM

DescriptionWeakness

Advisory Published

via GitHub·04:55 PM

Data Sourced

via GitHub·04:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using pypdf versions before 6.20.1 are exposed when they remove objects from PDF tree structures, such as outline items, while processing attacker-crafted PDFs with cyclic trees.

What does an attacker need to do to trigger the issue?

An attacker needs to provide a crafted PDF containing a cyclic tree and cause the application to remove an object from that tree. Successful triggering can cause the current process to loop indefinitely and become blocked.

Is there a mitigation if upgrading is not immediately possible?

Apply the changes from PR #4188 as a workaround. The permanent fix is to upgrade pypdf to version 6.20.1.

CVE-2026-113793: pypdf: Possible infinite loop when removing tree items

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

Is there a mitigation if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

Is there a mitigation if upgrading is not immediately possible?