CVE-2026-54651: pypdf Infinite Loop Denial of Service Vulnerability

Technical summary

CVE-2026-54651 is an infinite loop vulnerability (CWE-835) in pypdf prior to version 6.13.1. The flaw is triggered during PDF merge operations when a crafted input file containing threads or articles is processed by the library's writer functionality. The attack vector is local, requires low complexity, and demands low privilege level. The vulnerability results in availability impact through resource exhaustion via uncontrolled looping logic. No authentication, user interaction, or elevated privileges are needed to trigger the denial of service once an attacker-controlled PDF reaches the vulnerable code path.

Business impact

Applications relying on pypdf for automated PDF processing—including document management systems, report generators, and content workflow tools—face service disruption risk. If pypdf runs in a shared or cloud environment, a single malicious PDF could consume CPU resources and degrade service for other users or applications. For organizations processing untrusted PDF inputs (customer uploads, third-party documents), this vulnerability creates an easy path to denial of service without requiring network access or credentials. Recovery typically requires service restart, resulting in downtime and operational disruption.

Affected systems

Any system running pypdf versions prior to 6.13.1 is affected. The vulnerability is restricted to merge operations involving files with threads or articles, so not all PDF processing workflows trigger the flaw. Developers and organizations using pypdf in production, particularly those processing documents from untrusted or external sources, should prioritize upgrade assessment. The pure-Python nature of the library means it runs across all major operating systems where Python is available.

Exploitability

Exploitation requires local access and the ability to supply a crafted PDF file to an application using pypdf. The attack is not network-remotely exploitable and does not require special privileges or user interaction beyond normal file processing. The barrier to exploitation is low: an attacker simply needs to craft a PDF with specific structural characteristics (threads or articles) and ensure it reaches the vulnerable merge function. Proof-of-concept creation would be straightforward for someone familiar with PDF structure, making weaponization likely once details are disclosed.

Remediation

Upgrade pypdf to version 6.13.1 or later immediately. Verify the upgrade in your dependency management tool (pip, poetry, requirements.txt, etc.) and redeploy affected services. For organizations unable to patch immediately, implement input validation and sandboxing: reject PDFs from untrusted sources, isolate PDF processing in separate processes or containers, and set strict CPU/memory limits on processing tasks. Monitor resource consumption on services using pypdf as a temporary warning indicator.

Patch guidance

Update pypdf using your package manager: run `pip install --upgrade pypdf>=6.13.1` or update your requirements file and reinstall dependencies. Verify the installed version with `pip show pypdf`. Test the update in a staging environment before production deployment to ensure no compatibility issues with your application's PDF merge operations. Review any custom merge logic in your codebase to confirm it will benefit from the patched library behavior. No configuration changes are required; the fix is transparent upon upgrade.

Detection guidance

Monitor for signs of resource exhaustion during PDF processing: sustained high CPU usage on threads handling PDF merges, excessive memory allocation, or process hangs without corresponding network traffic or disk I/O. Check application logs for timeouts or incomplete merge operations. If you run pypdf in production, log the library version at startup and alert on mismatches. For threat hunting, identify all inbound or uploaded PDFs processed within a time window and correlate with performance degradation events. Examine the PDF metadata and structure of any file that preceded a performance incident to look for suspicious thread or article elements.

Why prioritize this

This vulnerability scores MEDIUM (5.5 CVSS) due to local-only access requirement and availability-only impact, but warrants relatively high prioritization for organizations processing external PDFs. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation and straightforward patch path argue for timely remediation. Prioritize based on whether your organization accepts untrusted PDF inputs; if you do, treat this as a near-term fix. For internal-only PDF processing, a standard quarterly patching cycle is acceptable.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects that exploitation requires local access (AV:L) and low complexity (AC:L), demands only low privileges (PR:L), needs no user interaction (UI:N), and impacts only availability (A:H) within a single security boundary (S:U). The score does not account for business context; organizations processing high volumes of untrusted PDFs face greater practical risk than the base score suggests. The absence of confidentiality or integrity impact prevents a higher severity rating, but the denial-of-service impact remains operationally significant.

Frequently asked questions