pypdf: Possible infinite loop when removing tree items
Impact
An attacker exploiting this vulnerability can craft a PDF that causes an infinite loop. This occurs when an object is removed from a tree, such as an outline item.
Patches
This issue has been resolved in pypdf==6.20.1.).
Workarounds
If you cannot upgrade immediately, consider applying the changes from PR #4188.).
What to do
Upgrade to pypdf version 6.20.1 (https://github.com/py-pdf/pypdf/releases/tag/6.20.1).). If an upgrade is not immediately feasible, apply the changes from pull request #4188 (https://github.com/py-pdf/pypdf/pull/4188).).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pypdf | < 6.20.1 | 6.20.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-835- Platform
- Python (PyPI)
- Package
pypdf- Disclosed
- 21.10.2026
- Updated
- 22.10.2026 10:00
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-9mx8-4j7g-633p - CC BY 4.0
Vulnerability history: pypdf
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 55
- First → latest
- 06.2023 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 10
- Medium 42
- Low 3
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 4
- 2026: 49
-
pypdf: Possible infinite loop when removing tree items this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.