GHSA-5849-834g-hvw5: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Q: Who is exposed to this issue?

Applications using pypdf before 6.21.4 are exposed when they open attacker-controlled or otherwise untrusted PDF files. The affected parsing path is reached by an incomplete PDF with a standard cross-reference table that ends without a trailer.

Q: What does an attacker need to do to trigger the problem?

The attacker needs to provide a crafted incomplete PDF and have a user or application open it with the affected pypdf version. No attacker privileges are required, but the malformed file must be processed.

Q: What is the practical impact of successful exploitation?

pypdf can repeatedly rewind during its trailer search without making parsing progress, causing an infinite loop. This blocks the processing thread and can result in a denial of service for the affected PDF-processing task.

Q: What should be done if upgrading is not immediately possible?

Apply the changes from PR #4289 as a workaround. Otherwise, avoid processing incomplete or untrusted PDFs where possible and isolate PDF processing so a blocked thread has limited operational impact.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer.

Patches

This has been fixed in pypdf==6.21.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4289.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.4

6.21.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4
Upgrade
Upgrade pypi/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4
Compensating control
If upgrading is not yet possible, apply the changes from PR #4289.

Event History

Oct 29, 2026

CVE Published

via OSV·08:30 PM

Data Sourced

via OSV·08:30 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:13 PM

Data Sourced

via GitHub·11:13 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:13 PM

Affected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using pypdf before 6.21.4 are exposed when they open attacker-controlled or otherwise untrusted PDF files. The affected parsing path is reached by an incomplete PDF with a standard cross-reference table that ends without a trailer.

What does an attacker need to do to trigger the problem?

The attacker needs to provide a crafted incomplete PDF and have a user or application open it with the affected pypdf version. No attacker privileges are required, but the malformed file must be processed.

What is the practical impact of successful exploitation?

pypdf can repeatedly rewind during its trailer search without making parsing progress, causing an infinite loop. This blocks the processing thread and can result in a denial of service for the affected PDF-processing task.

What should be done if upgrading is not immediately possible?

Apply the changes from PR #4289 as a workaround. Otherwise, avoid processing incomplete or untrusted PDFs where possible and isolate PDF processing so a blocked thread has limited operational impact.

GHSA-5849-834g-hvw5: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

What is the practical impact of successful exploitation?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

What is the practical impact of successful exploitation?

What should be done if upgrading is not immediately possible?