CVE-2026-119203 in pypdf
Summary
by MITRE • 10/29/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within the pypdf library prior to version 6.21.4 represents a significant reliability and availability risk stemming from inadequate input validation during PDF parsing operations. As an open-source Python library designed for reading, writing, and manipulating PDF documents, pypdf is frequently utilized in automated workflows where large volumes of untrusted or semi-trusted files are processed. The core issue lies in the parser's handling of malformed PDF structures, specifically those involving incomplete cross-reference tables that terminate at the end of the file without a proper trailer section. In standard PDF specifications, the trailer provides essential metadata and pointers to document objects, including the location of the root object and other critical structural elements. When this structure is missing or corrupted, the parser's logic for locating these components fails to account for edge cases where no progress can be made in parsing the file structure.
The technical flaw manifests as an infinite loop within the trailer search mechanism. Upon encountering a crafted PDF that lacks a valid trailer but contains standard cross-reference table entries reaching the end of the stream, the parser attempts to locate necessary document information by rewinding through the file content. Because the input is designed such that no progress can be made in identifying valid objects or trailers, the algorithm repeatedly returns to the same stream position without detecting this lack of forward movement. This behavior violates basic principles of robust state machine design, which should include cycle detection or maximum iteration limits when searching for structural markers within a finite file size. Consequently, the processing thread becomes permanently blocked, consuming CPU resources indefinitely and preventing any further operations on that thread until external intervention occurs.
From an operational perspective, this vulnerability poses a direct threat to service availability, particularly in environments where pypdf is used in server-side applications or automated document processing pipelines. An attacker can exploit this flaw by submitting specifically crafted PDF files through any interface that accepts user-uploaded documents for analysis, conversion, or extraction of text and images. The resulting denial-of-service condition effectively halts the application's ability to process subsequent requests on the affected thread, potentially leading to resource exhaustion if multiple such attacks are launched concurrently. This aligns with Common Weakness Enumeration category CWE-835, which describes loops that do not terminate due to a missing or incorrect termination condition, and also relates to CWE-400 regarding uncontrolled resource consumption. In terms of the MITRE ATT&CK framework, this vulnerability facilitates availability impact scenarios often associated with Denial-of-Service attacks against web applications or data processing services.
Mitigation for this issue requires an immediate upgrade to pypdf version 6.21.4 or later, where the parsing logic has been corrected to detect when no progress is being made during trailer searches and terminate gracefully rather than entering an infinite loop. For systems that cannot immediately update due to dependency constraints, implementing a timeout mechanism around PDF processing tasks can serve as a temporary compensating control. This involves wrapping the pypdf operations in a context manager or thread with a strict execution time limit, ensuring that any hanging process is forcibly terminated after a predefined duration. Additionally, organizations should implement input validation and sanitization strategies at the application boundary to reject malformed files before they reach the parsing engine, thereby reducing the attack surface for such structural exploitation attempts.