CVE-2026-113792 in pypdf
Summary
by MITRE • 10/22/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within the pypdf library represents a significant availability risk stemming from improper input validation of hierarchical data structures during document parsing operations. Specifically, the flaw resides in the PdfWriter.find_outline_item method, which is designed to locate specific items within a PDF outline hierarchy. In versions prior to 6.20.1, this function fails to implement adequate cycle detection mechanisms when traversing the linked list structure that constitutes the PDF outline. A maliciously crafted PDF file can exploit this deficiency by embedding an outline where parent and child nodes reference each other in a circular manner, creating a cyclic hierarchy rather than a valid tree structure.
When an application utilizes pypdf to process such a malformed document, the find_outline_item method initiates a traversal of the outline items. Because the algorithm relies on recursive or iterative navigation without tracking visited nodes or enforcing depth limits, it enters an infinite loop upon encountering the circular reference. This uncontrolled iteration consumes CPU resources indefinitely and blocks the current execution thread. In server-side applications where pypdf is used to process user-uploaded documents, this behavior can lead to a denial of service condition by exhausting available threads or causing application timeouts that degrade service availability for other users.
From a classification perspective, this vulnerability aligns with CWE-835, which describes the use of loops in a way that causes an infinite loop, and CWE-770, regarding allocation of resources without limits. The attack vector corresponds to ATT&CK technique T1496, Resource Hijacking, specifically through CPU consumption via denial of service. The exploitation requires only the ability to provide or influence the input PDF file, which is a common scenario in document management systems, email gateways processing attachments, and web applications that allow users to upload files for conversion or analysis.
The operational impact of this flaw extends beyond simple process blocking. In multi-threaded environments such as those built with Python frameworks like Django or Flask using thread pools, the blocked threads reduce the overall capacity of the application to handle legitimate requests. This can result in cascading failures where other services dependent on the affected application experience latency or failure due to resource starvation. Furthermore, if the blocking occurs during a critical security check or audit trail generation, it may inadvertently bypass logging mechanisms depending on how the error handling is implemented around the vulnerable function call.
Mitigation strategies primarily involve upgrading the pypdf library to version 6.20.1 or later, where the developers have implemented safeguards against cyclic references in outline hierarchies. For organizations unable to immediately patch their dependencies, defensive coding practices should be adopted within application logic that consumes PDF data. This includes implementing timeout mechanisms for parsing operations and validating document structures before passing them to vulnerable library functions. Additionally, input validation at the network perimeter can help filter out obviously malformed files, although deep inspection of internal object references is typically required to fully mitigate this class of vulnerability. Regular dependency audits are essential to ensure that known vulnerabilities in third-party libraries do not introduce availability risks into production environments.