pypdf is a pure‑python PDF library that, prior to version 6.20.0, could be tricked into reading an incomplete PDF whose cross‑reference table stops abruptly at end‑of‑file. The library then incorrectly processes the incomplete table and falls into a never‑ending loop, exhausting the interpreter’s stack or CPU resources. The flaw is classified as CWE‑835, an infinite loop weakness that results in a denial of service rather than exploitation of integrity or confidentiality.

The affects all installations using the py‑pdf:pypdf library with a version earlier than 6.20.0. No other vendors or product lines are listed as impacted.

The CVSS score of 6.0 places this issue in the medium severity range. EPSS data is not available, so the likely exploitation rate remains uncertain, but the fact that the flaw is triggered by an adversarial PDF makes it a practical risk for any application that parses PDFs from untrusted sources. The vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed widespread exploitation yet. Attackers can feed a crafted PDF into any process that imports pypdf, potentially causing a service interruption.