{"id":"CVE-2026-113794","published":"2026-10-21T16:17:28.707","lastModified":"2026-10-22T16:46:48.920","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58","tags":[]},{"url":"https://github.com/py-pdf/pypdf/issues/4169","tags":[]},{"url":"https://github.com/py-pdf/pypdf/pull/4170","tags":[]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.20.0","tags":[]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3","tags":[]}],"exploitRefs":[{"url":"https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58","tags":[]},{"url":"https://github.com/py-pdf/pypdf/issues/4169","tags":[]},{"url":"https://github.com/py-pdf/pypdf/pull/4170","tags":[]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.20.0","tags":[]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3","tags":[]}],"hasPoc":true,"ai":null}