CVE-2026-54530: pypdf Infinite Loop DoS Vulnerability – Patch to 6.13.0

Technical summary

CVE-2026-54530 is an infinite loop vulnerability (CWE-835) in pypdf prior to version 6.13.0. The defect is present in the text extraction logic when operating in layout mode. A maliciously constructed PDF can cause the text extraction routine to enter an infinite loop, consuming CPU resources and blocking execution. The vulnerability requires local access and user interaction (launching text extraction), but once triggered, causes a complete denial of service for the affected process.

Business impact

Organizations relying on pypdf for automated PDF processing, document management systems, or batch text extraction face service disruption risks. If pypdf is embedded in server applications or background workers, a crafted PDF could cause worker threads to hang, degrading system responsiveness or causing task queues to back up. The denial-of-service nature means availability is compromised, but confidentiality and integrity are not at risk. For critical document processing workflows, this could impact SLA compliance and user-facing services.

Affected systems

Any application or service using pypdf versions prior to 6.13.0 is vulnerable. This includes Python applications performing PDF text extraction in layout mode, as well as any third-party tools or web services that depend on this library. Organizations should inventory all internal and third-party dependencies on pypdf to identify exposure.

Exploitability

Exploitation requires an attacker to deliver a malicious PDF to a target application and have that application perform text extraction in layout mode. The attack does not require elevated privileges or network access—a local or web-submitted file will trigger the vulnerability. However, the attacker must know or guess that layout mode text extraction will be performed. The bar for weaponization is moderate; automated detection of vulnerable applications is possible, but targeted attacks would likely require some reconnaissance of deployed pypdf configurations.

Remediation

Update pypdf to version 6.13.0 or later. Organizations should treat this as a standard maintenance update for open-source dependencies. Verify the update in your package management system (pip, poetry, etc.) and perform regression testing on text extraction workflows. For applications that cannot be immediately updated, temporary mitigation includes disabling layout mode text extraction or restricting PDF input to trusted sources.

Patch guidance

Upgrade pypdf to version 6.13.0 or newer via your package manager (e.g., 'pip install --upgrade pypdf'). Verify the installed version using 'pip show pypdf' and confirm version 6.13.0 or later. Test text extraction functionality after upgrade to ensure no breaking changes affect your application. For applications in production, consider a staged rollout with a development/staging environment test first. Review pypdf release notes for any additional changes in 6.13.0.

Detection guidance

Monitor for process hangs or high CPU usage correlated with PDF text extraction operations. Check application logs for incomplete or stalled extraction tasks. If using application performance monitoring (APM) or logging, look for text extraction calls that do not complete within expected timeframes. Vulnerability scanning tools should detect pypdf versions prior to 6.13.0 in dependency manifests (requirements.txt, poetry.lock, setup.py, pyproject.toml).

Why prioritize this

Although the CVSS score of 5.5 (MEDIUM) reflects the availability impact and local access requirement, the ease of exploitation and broad use of pypdf in document processing pipelines warrant prompt patching. This is not an emergency, but should be included in the next standard maintenance cycle. Organizations with PDF processing as a core service should prioritize this higher.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity vulnerability with local attack vector, low complexity, and low privileges required, but with no confidentiality or integrity impact—only availability. The infinite loop causes denial of service rather than system compromise. The score does not account for business context; individual organizations may assess risk differently based on how critical PDF processing is to their operations.

Frequently asked questions