pypdf, a popular pure‑Python PDF library, contains a flaw that can cause the parser to enter an infinite loop while searching for the trailer of a PDF that ends its cross‑reference table at EOF. This loop repeatedly rewinds to the same stream position and never terminates, leaving the thread that processes the PDF blocked and consuming CPU resources. The weakness is classified as CWE‑835, an improper termination of a loop or iteration, and the result is a denial of service, not a code‑execution or data‑leak vulnerability.

All installations of py‑pdf's pypdf library that are older than version 6.21.4 are vulnerable. The fix is issued in release 6.21.4 and later versions. Applications that import and use pypdf—whether locally or as part of a web service—must ensure they are running a patched version to avoid exposure.

The CVSS score of 7.1 indicates a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a mitigated EPSS does not diminish the risk when the vulnerable library processes untrusted PDFs. An attacker can trigger the infinite loop by supplying a crafted incomplete PDF file to any code path that uses pypdf for parsing. Because the loop blocks the thread but does not exit the process, the attack can stall a single background worker or, in multi‑threaded environments, exhaust the pool of worker threads, leading to degraded performance or denial of service for legitimate users.