CVE-2026-119203: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4289.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.4 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.4 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4289.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions prior to 6.21.4 may be affected when they open attacker-controlled or otherwise incomplete PDF files. The listed affected package ecosystems are Debian pypdf, Debian pypdf2, and pip pypdf.
What must an attacker provide to trigger the denial of service?
The attacker needs to induce processing of a crafted incomplete PDF containing a standard cross-reference table that reaches end-of-file without a trailer. Opening the file can cause the processing thread to block in an infinite loop.
Does exploitation require authentication or user interaction?
The provided severity vector indicates network attackability, low attack complexity, no privileges required, and user interaction is required. The issue is triggered when the crafted PDF is opened by pypdf.
What should teams do if they cannot upgrade immediately?
Upgrade to pypdf 6.21.4 when possible. If an immediate upgrade is not possible, the provided workaround is to apply the changes from PR #4289.
How can I determine whether a running workload may be vulnerable?
Check whether it uses a pypdf version earlier than 6.21.4 and processes PDFs that may be incomplete or attacker supplied. Affected behavior occurs during trailer searching when a standard cross-reference table reaches EOF without a trailer.