CVE-2026-119203：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
漏洞详情
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
风险评估
- CVSS 评分：7.1（HIGH）
- 评分版本：CVSS 4.0
- 攻击向量：
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
弱点类型
CWE-835
参考链接
- https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a
- https://github.com/py-pdf/pypdf/pull/4289
- https://github.com/py-pdf/pypdf/releases/tag/6.21.4
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。
原文链接： CVE-2026-119203：pypdf is a free and open-source pure-python PDF library. Prior to 6.21