CVE-2026-113794: pypdf Infinite Loop Vulnerability in Xref Table
Summary
CVE-2026-113794: pypdf: Possible infinite loop when hitting EOF in standard xref table. Affects pypdf versions < 6.20.0. Fixed in 6.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a popular Python library used for manipulating PDF files. It allows users to create, modify, and extract information from PDFs. The library is widely utilized in various applications due to its ease of use and comprehensive features. However, it is susceptible to a specific vulnerability that can lead to an infinite loop when processing certain malformed PDF files, particularly those with incomplete xref tables.
Vulnerability Detail
The vulnerability arises when an attacker crafts a PDF file that ends prematurely within the xref table, causing the pypdf library to enter an infinite loop during processing. This can lead to denial of service, as the application may become unresponsive while attempting to read the corrupted file. The issue has been classified under CWE-835, which pertains to infinite loops in software.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.20.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.20.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can apply the changes from the pull request #4170 on GitHub. This involves modifying the code to handle incomplete xref tables more gracefully, preventing the infinite loop from occurring.
Conclusion
The pypdf library has a vulnerability (CVE-2026-113794) that can lead to an infinite loop when processing malformed PDF files. Users are advised to upgrade to version 6.20.0 or later to fix this issue. For those unable to upgrade immediately, applying the suggested workaround can help mitigate the risk.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The primary impact is denial of service, as the application may become unresponsive when processing a specially crafted PDF file that triggers the infinite loop.
While the vulnerability primarily leads to denial of service, it does not directly cause data loss. However, it can disrupt normal operations and affect user experience.
If immediate upgrading is not feasible, consider applying the workaround by implementing the changes from pull request #4170 to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
