CVE-2026-113794

Analyzed Analyzed - Analysis Complete

Infinite Loop in pypdf Due to Incomplete PDF Handling

Publication date: 2026-10-21

Last updated on: 2026-11-02

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-02

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113794

EUVD

EUVD-2026-107335

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.20.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability affects the PyPDF library versions before 6.20.0. An attacker can create a malformed PDF file that ends inside a standard cross-reference table. When PyPDF processes this file, it enters an infinite loop because it mishandles the unexpected end of file during parsing.

Detection Guidance

To detect this vulnerability, check if your system uses PyPDF versions before 6.20.0. Run: pip show pypdf. If the version is less than 6.20.0, the system is vulnerable. Additionally, monitor for processes hanging when processing PDF files, which may indicate an infinite loop.

Impact Analysis

If you use a vulnerable version of PyPDF to process PDF files, an attacker could send a specially crafted file that causes your application to hang indefinitely. This could lead to denial of service, disrupting services that rely on PDF processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves an infinite loop in PDF processing due to malformed xref tables, which could cause application hangs but does not inherently lead to data breaches or unauthorized access. Compliance impacts would only occur if the vulnerability indirectly caused system unavailability or disrupted logging/reporting functions.

Mitigation Strategies

Upgrade PyPDF to version 6.20.0 or later using: pip install --upgrade pypdf. If upgrading is not possible, apply changes from pull request #4170 as a temporary workaround. Avoid processing untrusted PDF files until patched.

Hi! I’m here to help you understand CVE-2026-113794. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...