CVE-2026-113794: pypdf infinite loop in PDF cross-reference table parsing

CVE-2026-113794 · Severity: medium · CVSS 4 · Published 2026-10-21

pypdf is a Python library for reading and manipulating PDF files. An attacker can craft a malformed PDF that causes the library to enter an infinite loop when parsing the file's cross-reference table, rendering any application using pypdf unresponsive and unable to process other requests. This can be used as a denial-of-service vector against services that accept and process PDF uploads.

Technologies: Py-Pdf Pypdf, pypdf (PyPI). Vendors: Py-Pdf, PyPI.

Quick answers

Is CVE-2026-113794 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113794 being exploited in the wild.
How severe is CVE-2026-113794?
Medium severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?
Py-Pdf Pypdf prior to 6.20.0; pypdf (PyPI) < 6.20.0, ECOSYSTEM:introduced=0,fixed=6.20.0.
Is there a fix for CVE-2026-113794?
Yes. pypdf (PyPI): upgrade to 6.20.0 or later. Until then: Restrict file upload sizes and implement timeouts on PDF parsing operations to prevent denial-of-service attacks while awaiting the patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113794 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-113794?
Check whether you run Py-Pdf Pypdf or pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pypdf (PyPI): upgrade to 6.20.0 or later
    pip install "pypdf>=6.20.0"

Restrict file upload sizes and implement timeouts on PDF parsing operations to prevent denial-of-service attacks while awaiting the patched version.

Technical details

The vulnerability exists in the _read_standard_xref_table method, which contains a loop that attempts to handle whitespace at the end of cross-reference tables. When the cross-reference table ends with a short line near the end of file that starts with CR or LF, the stream.read(20) call returns fewer than 20 bytes, but the code assumes it always returns exactly 20 bytes. This causes seek(-20+1, 1) to move back to the same position, creating an infinite loop. An attacker triggers this by crafting an incomplete PDF with a malformed xref table.

Affected products

  • py-pdf pypdf prior to 6.20.0

Identifiers

  • CVE-2026-113794
  • GHSA-39mj-jf6j-2qj3

Timeline

  • 2026-10-21: disclosed
  • 2026-10-08: patched: Fix committed addressing EOF handling in xref table parsing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.