Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
Related Weaknesses (CWE)
References
- https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a
- https://github.com/py-pdf/pypdf/pull/4289
- https://github.com/py-pdf/pypdf/releases/tag/6.21.4
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
FAQ
What is CVE-2026-119203?
CVE-2026-119203 is a documented vulnerability. pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end o...
How severe is CVE-2026-119203?
CVSS scoring is not yet available for CVE-2026-119203. Check NVD for updates.
Is there a patch for CVE-2026-119203?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.