Executive brief
pypdf is a widely used Python library for reading, splitting, and merging PDF files. A vulnerability in the library allows a specially crafted PDF file to cause the software to enter an infinite loop when attempting to extract text. This can lead to a denial-of-service (DoS) condition, causing applications or services processing the file to hang or crash, potentially disrupting business operations that rely on automated PDF processing.
Technical details
A vulnerability classified as CWE-835 (Loop with Unreachable Exit Condition) exists in pypdf prior to version 6.13.0. The flaw is triggered when the library attempts to extract text using 'layout mode' or when retrieving fonts for outlines. An attacker can exploit this by providing a maliciously crafted PDF file that causes the parser to enter an infinite loop. This results in a denial-of-service (DoS) by exhausting CPU resources. The issue is fixed in version 6.13.0 by implementing checks to avoid infinite loops during font retrieval and text extraction.
Affected products
- py-pdf pypdf < 6.13.0
Timeline
- 2026-06-05: patched: Version 6.13.0 released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-52x6-gq3r-vpf4 published
- 2026-06-22: disclosed: CVE-2026-54530 published to NVD