Live › vulnerability › CVE-2026-113794
Go to dashboardpypdf, a Python PDF library, enters an infinite loop when parsing a PDF whose standard xref table is cut off at end of file. An attacker who supplies a crafted truncated PDF can hang the process that parses it, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pypdf | pypi | < 6.20.0 | 6.20.0 |
Run pip show pypdf and check whether the version is below 6.20.0.
6.20.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.
This has been fixed in pypdf==6.20.0.
If you cannot upgrade yet, consider applying the changes from PR #4170.
This has been reported through both the secure channel and as a public issue at #4169.
This page as .md · .json · in your agent: get_signal("CVE-2026-113794")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.