Executive brief
pypdf is a popular Python library used for manipulating and analyzing PDF files. A vulnerability in how it processes certain PDF structures can allow an attacker to provide a specially crafted file that causes the application to hang or run extremely slowly. This could lead to a denial-of-service, impacting the availability of automated document processing systems.
Technical details
An excessive iteration vulnerability (CWE-834) exists in pypdf when parsing cross-reference streams. The issue is triggered by cross-reference streams containing zero-only width values (/W [0 0 0]) combined with large /Size values. An attacker can exploit this by providing a malicious PDF file that, when processed, causes the library to enter a long-running loop. This results in a denial-of-service (DoS) condition. The vulnerability is fixed in version 6.12.0; a workaround involves applying the changes from pull request #3791.
Affected products
- py-pdf pypdf < 6.12.0
Timeline
- 2026-05-21: disclosed: Initial disclosure by stefan6419846
- 2026-05-28: advisory: NVD publication date
- 2026-06-12: patched: Version 6.12.0 released