CVE-2026-113794 · GHSA-39mj-jf6j-2qj3
pypdf: Possible infinite loop when hitting EOF in standard xref table
- Risk score
- 49/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.
- Affected
- pypdf (pip) < 6.20.0
- Fix
- Upgrade pypdf to 6.20.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
pypdf: Amber, patch this week. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6…
The flaws
- CVE-2026-113794: Possible infinite loop when hitting EOF in standard xref table (CVSS 6.0 · EPSS 0%)
- CVE-2026-115572: Possible long runtimes for repeated references to the same missing object (CVSS 7.1 · EPSS 1%)
- CVE-2026-115585: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1 · EPSS 1%)
- CVE-2026-115580: Possible long runtimes for large xref table header limits (CVSS 7.1 · EPSS 1%)
The fix
Upgrade pypdf: 6.20.0 · 6.21.2 or later on your release line
Who is exposed: pypdf (pip) < 6.21.2
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-835 (CWE-835). 53 other warnings in 30 days
Why it is Yellow
- CVSS 6.0 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pypdf | pip | < 6.20.0 | 6.20.0 |
References
- https://github.com/advisories/GHSA-39mj-jf6j-2qj3
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3
- https://github.com/py-pdf/pypdf/issues/4169
- https://github.com/py-pdf/pypdf/pull/4170
- https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58
- https://github.com/py-pdf/pypdf/releases/tag/6.20.0
- https://github.com/advisories/GHSA-39mj-jf6j-2qj3
Original description
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.
Last activity 21 Oct 2026. Patch Forecast updates every hour.