CVE-2026-113792

Analyzed Analyzed - Analysis Complete

Out-of-Control Loop in pypdf PDF Library

Publication date: 2026-10-21

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113792

EUVD

EUVD-2026-107333

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.20.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability affects the pypdf library versions prior to 6.20.1. It involves a possible infinite loop in the PdfWriter.find_outline_item function when processing a crafted PDF with a cyclic outline hierarchy. The issue allows an attacker to trigger an infinite loop by exploiting this function.

Detection Guidance

To detect this vulnerability, check if your system uses pypdf versions prior to 6.20.1. Run: pip show pypdf to check the installed version. If vulnerable, look for processes stuck in infinite loops when processing PDFs with cyclic outlines.

Impact Analysis

The vulnerability can cause denial of service by blocking the current process due to an infinite loop. This may lead to application unresponsiveness or crashes when processing malicious PDF files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is a denial-of-service (DoS) risk via infinite loop in a PDF processing library, which could disrupt services but does not inherently violate data protection or privacy requirements.

Mitigation Strategies

Upgrade pypdf to version 6.20.1 or later using pip install --upgrade pypdf. If immediate upgrade is not possible, apply the changes from pull request #4188 as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-113792. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...