Skip to content
Fencer Vulns
medium 5.5

CVE-2026-119203 json

pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search

published 2026-10-29 10 d ago modified 2026-11-02 6 d ago also GHSA-5849-834g-hvw5 , EUVD-2026-113374

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.

Patch / fix

  • pypi pypdf 6.21.4
  • py-pdf pypdf 6.21.4
  • pypdf Debian 14 6.21.4-1

debian advisories DEBIAN-CVE-2026-119203

  • python-pypdf openSUSE Leap 16.0 6.19.0-bp160.3.1

opensuse advisories openSUSE-SU-2026:22219-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-119203 updated cvss 5.5

pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-backend-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
    affected: workaround, no fix available “Upgrade pypdf to 6.21.4. As a workaround, apply the PR #4289 changes or avoid processing untrusted or incomplete PDF files.”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-chatbot-rhel8
    affected: workaround, no fix planned “Upgrade pypdf to 6.21.4. As a workaround, apply the PR #4289 changes or avoid processing untrusted or incomplete PDF files.”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-ogx-core-rhel9, rhoai/odh-llama-stack-core-rhel9
    affected: workaround, no fix available “Upgrade pypdf to 6.21.4. As a workaround, apply the PR #4289 changes or avoid processing untrusted or incomplete PDF files.”
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    affected: workaround, no fix planned “Upgrade pypdf to 6.21.4. As a workaround, apply the PR #4289 changes or avoid processing untrusted or incomplete PDF files.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9 d ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi pypdf
<6.21.4
6.21.4

Affected products

  • py-pdf pypdf

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.