HighVulnerabilityCVE-2026-119203updated 30 Oct 2026, 23:14 UTC

pypdf can hang forever on a crafted incomplete PDF file

A specially built, broken PDF file can make the pypdf Python library freeze instead of finishing its work. Anything that opens such a file can get stuck waiting, which can block a service.

Fixed in pypdf 6.21.4 · out 2026-10-30 23:14 UTCOfficial, 2 sources

Severity	HighCVSS 7.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yespypdf 6.21.4 · since 30 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Attacker crafts PDFFile has xref table but no trailer
2App opens the fileUploaded or received PDF is parsed
3pypdf searches trailerSearch rewinds to same position repeatedly
4Thread blocks foreverNo progress is ever made
ResultProcessing thread hangs indefinitely

What happened

pypdf before 6.21.4 can enter an infinite loop while searching for the trailer of a PDF whose cross-reference table reaches end-of-file without a trailer; the trailer search rewinds to the same stream position without making progress, blocking the processing thread.

Why it is dangerous: A single malicious PDF can tie up a thread or process indefinitely, causing denial of service in any application that parses untrusted PDFs with pypdf.

Are you affected?

You are affected if you use pypdf older than 6.21.4 to open or process PDF files, especially PDFs from untrusted sources such as uploads or email attachments.

Package / product	Affected versions	Fixed in
pypdf · pip	< 6.21.4	6.21.4

What to do

Update pypdf to version 6.21.4 or later (pip install --upgrade pypdf)
If you cannot upgrade yet, apply the changes from PR #4289 in the pypdf repository
Set timeouts or run PDF processing in isolated worker processes so a hang cannot block your main service

Timeline

29 Oct 2026, 21:17 UTC
Publicly disclosed
29 Oct 2026, 21:17 UTC
Reported by NVD · NVD
29 Oct 2026, 21:21 UTC
Picked up by Zero Radar
30 Oct 2026, 23:14 UTC
GitHub Advisory reported on it · GitHub Advisory
30 Oct 2026, 23:14 UTC
Fixed version published: pypdf 6.21.4 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-119203NVD · 29 Oct 2026, 21:17 UTC
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchGitHub Advisory · 30 Oct 2026, 23:13 UTC

Technical details

ID: CVE-2026-119203 · GHSA-5849-834g-hvw5
CVSS: 7.1 / 10
Disclosed: 29 Oct 2026, 21:17 UTC
On Zero Radar: 29 Oct 2026, 21:21 UTC (4 min after disclosure)
Last change: 30 Oct 2026, 23:14 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works