CVE-2026-113792: DoS in pypdf from cyclic outlines

pypdf before 6.20.1 is vulnerable to DoS from infinite loop on PDFs with cyclic hierarchical outlines.

CVE-2026-113792 is a denial-of-service vulnerability in pypdf, a free and open-source Python library widely used in production systems. The bug freezes the process when handling a PDF with cyclic outline hierarchies (self-referencing chains that create infinite loops). It does not execute remote code or leak data, but prevents the service from functioning until restart. For organizations using pypdf on servers to process PDFs, the risk is concrete if files come from external sources: uploads, email, APIs, partners.

The vulnerability carries a CVSS score of 6.0 (medium), but warrants attention. The patch was released on October 21, 2026 with version 6.20.1. A critical signal arrived on October 29, 2026, when a GitHub repository with verified proof-of-concept code was publicly disclosed, confirming the bug is trivial to exploit: only a specially crafted PDF is needed. Signals across official description and public disclosure are consistent: all describe a pure DoS without privilege escalation. This means the attack vector is solidified and replicable.

For IT teams: immediately audit your inventory to identify every application in production that depends on pypdf. Prioritize systems accepting PDF files from users, partners or external sources. Plan an upgrade to version 6.20.1 or later following your environment's testing procedures. If immediate upgrade is not possible, restrict access to PDF parsing services or disable outline processing if configurable. Monitor logs for process crashes or hangs.

At a glance

What: pypdf is an open-source Python library for PDF manipulation. The outline processing does not properly validate hierarchy in specially crafted PDFs: a document with cyclic references causes an infinite loop that blocks the process.
Severity: CVSS 6.0 (medium). This is a pure denial of service: the application hangs and does not process other requests until restart. No remote code execution.
Affected versions: pypdf < 6.20.1
Fix: Update to pypdf 6.20.1 or later. Patch available since October 21, 2026.
Status: Official fix in production. On October 29, 2026, GitHub repositories with verified proof-of-concept code were publicly disclosed, confirming the exploit's triviality.
Action: Inventory every production system using pypdf. Highest priority: services processing PDFs from uploads, email, APIs or partners. Update immediately to 6.20.1+. If not immediately feasible: restrict access to PDF parsing services or disable outline processing if configurable. Monitor logs for process crashes or hangs.

Sources: NVD, CVE-2026-113792

← All articles