Package vulnerability, severity high

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Published October 30, 2026, updated October 31, 2026

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search. Source: GHSA-5849-834g-hvw5 (CVE-2026-119203).

What's affected

• pypdf (pypi)<6.21.4

What to do

1. Upgrade pypdf to 6.21.4 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-5849-834g-hvw5

References

• https://osv.dev/vulnerability/GHSA-5849-834g-hvw5
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
• https://nvd.nist.gov/vuln/detail/CVE-2026-119203
• https://github.com/py-pdf/pypdf/pull/4289
• https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.21.4

Notice ghsa-5849-834g-hvw5, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.