Live › vulnerability › CVE-2026-113792
Go to dashboardpypdf's PdfWriter.find_outline_item can enter an infinite loop when given a crafted PDF, causing the process to hang. An attacker who can supply a PDF to code that calls this method can stall that process (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.20.1 | 6.20.1 |
pip show pypdf or check requirements/lockfiles for pypdf versions below 6.20.16.20.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling find_outline_item on a PdfWriter.
This has been fixed in pypdf==6.20.1.
If you cannot upgrade yet, consider applying the changes from PR #4188.
This page as .md · .json · in your agent: get_signal("CVE-2026-113792")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.