OSV security advisoryHigh
High advisory for pypdf
GHSA-5849-834g-hvw5 · Reported 30 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
pypdfAffected product
Advisory overview
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a `trailer`. ### Patches This has been fixed in [pypdf==6.21.4](https://github.com/py-pdf/pypdf/releases/tag/6.21.4). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4289](https://github.com/py-pdf/pypdf/pull/4289).
Affected packages and releases
PyPI / pypdf
1.0, 1.1, 1.10, 1.11, 1.12, 1.13, 1.2, 1.3
Also known as
CVE-2026-119203