Executive brief
pypdf is a popular Python library for reading and manipulating PDF files. A vulnerability allows an attacker to craft a malicious PDF that causes an infinite loop when the library attempts to load cross-reference data, potentially leading to a denial of service that consumes CPU resources and halts PDF processing.
Technical details
The vulnerability is a classic infinite loop (CWE-835) triggered by circular /Prev entries in PDF cross-reference streams. When pypdf parses a PDF file, it follows the /Prev chain in the xref stream to reconstruct document history; a circular reference causes this chain-following logic to loop indefinitely. The attack vector is network/local file access: an attacker must craft a malicious PDF and trick a user or system into opening it. The vulnerability affects all versions prior to 6.7.2 and has been patched in that release.
Affected products
- py-pdf pypdf before 6.7.2
Timeline
- 2026-02-22: disclosed: Advisory published on GitHub
- 2026-02-25: patched: Fix released in pypdf 6.7.2