GHSA-qfv9-64jg-mh7p: Pip/pypdf vulnerability

Q: What application behavior is required for this issue to be triggered?

The affected application must call find_outline_item on a PdfWriter while processing a crafted PDF. The issue is not described as being triggered merely by opening or parsing a PDF.

Q: Which release fixes the infinite-loop condition?

The issue is fixed in pypdf 6.20.1.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4188 as a workaround.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling findoutlineitem on a PdfWriter.

Patches

This has been fixed in pypdf==6.20.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4188.

Affected Software

1 affected componentFixes available

pip/pypdf<6.20.1

6.20.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.1
Compensating control
If upgrading is not yet possible, apply the changes from PR #4188.

Event History

Oct 21, 2026

Advisory Published

via GitHub·04:55 PM

Data Sourced

via GitHub·04:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What application behavior is required for this issue to be triggered?

The affected application must call find_outline_item on a PdfWriter while processing a crafted PDF. The issue is not described as being triggered merely by opening or parsing a PDF.

Which release fixes the infinite-loop condition?

The issue is fixed in pypdf 6.20.1.

What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4188 as a workaround.

GHSA-qfv9-64jg-mh7p: Pip/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What application behavior is required for this issue to be triggered?

Which release fixes the infinite-loop condition?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What application behavior is required for this issue to be triggered?

Which release fixes the infinite-loop condition?

What can be done if upgrading is not immediately possible?