Live › vulnerability › CVE-2026-113793
Go to dashboardpypdf, a Python PDF library, can enter an infinite loop when it removes an object from a PDF tree such as an outline item in a crafted file. An attacker who supplies such a PDF can hang the process that parses it, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.20.1 | 6.20.1 |
pip show pypdf and check whether the version is below 6.20.16.20.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.
This has been fixed in pypdf==6.20.1.
If you cannot upgrade yet, consider applying the changes from PR #4188.
This page as .md · .json · in your agent: get_signal("CVE-2026-113793")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.