cyfenced.com →

[ CVE-2026-119203 · Published 29 Oct 2026 ]

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

CVSS 5.5 EPSS <1%Fix available

[ Description ]Official description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.

[ Fixes ]Fixes and patches

  • pypdf 6.21.4Fixed version · GitHub Advisories · pip package pypdf: upgrade to 6.21.4 or later (affected < 6.21.4)
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

[ References ]References