GHSA-39mj-jf6j-2qj3: Pip/pypdf vulnerability

Q: What does an attacker need to provide to trigger the issue?

The attacker must supply a crafted, incomplete PDF file that ends inside the xref table. Processing that file with an affected pypdf version can cause an infinite loop.

Q: Which pypdf version contains the fix?

The issue is fixed in pypdf 6.20.0.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from pull request #4170 as a workaround.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.

Patches

This has been fixed in pypdf==6.20.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4170.

Notes

This has been reported through both the secure channel and as a public issue at #4169.

Affected Software

1 affected componentFixes available

pip/pypdf<6.20.0

6.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0

Event History

Oct 21, 2026

Advisory Published

via GitHub·04:54 PM

Data Sourced

via GitHub·04:54 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

The attacker must supply a crafted, incomplete PDF file that ends inside the xref table. Processing that file with an affected pypdf version can cause an infinite loop.

Which pypdf version contains the fix?

The issue is fixed in pypdf 6.20.0.

What can be done if upgrading is not immediately possible?

Consider applying the changes from pull request #4170 as a workaround.

GHSA-39mj-jf6j-2qj3: Pip/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

Which pypdf version contains the fix?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

Which pypdf version contains the fix?

What can be done if upgrading is not immediately possible?