Live › vulnerability › CVE-2026-119203
pypdf, a pure-Python PDF library, can hang forever when it opens a crafted PDF whose cross-reference table reaches end of file without a trailer. The stuck processing thread blocks the application, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications that use pypdf to parse PDF files, especially those that open PDFs supplied by users or external sources, can be blocked by a crafted file. Apps that only process PDFs they generate themselves or never parse untrusted input are less exposed. The sources do not describe whether a hang can be triggered from the internet without authentication.
No product ranges from the sources yet.
pip show pypdf or python -c "import pypdf; print(pypdf.__version__)"6.21.46.21.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-119203")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.