Infinite Loop Vulnerability in pypdf by py-pdf

CVE-2026-119203

What is CVE-2026-119203?

The pypdf library, a widely-used pure-Python PDF manipulation tool, contains a vulnerability that allows an infinite loop to occur when processing a specially crafted incomplete PDF file. Specifically, this issue arises if the standard cross-reference table encounters the end of the file without a proper trailer, resulting in the parser repeatedly attempting to access the same stream position instead of concluding when no progress is made. As a consequence, this can lead to blocked threads, adversely affecting application performance. The vulnerability has been addressed in version 6.21.4, and users are recommended to update to this version to mitigate the risk.

References