Executive brief
pypdf is a widely used Python library for reading, splitting, and merging PDF files. A vulnerability in the library allows a specially crafted PDF file to cause the software to enter an infinite loop when processing bookmarks or outlines. This can lead to a denial-of-service (DoS) condition, causing applications using the library to hang or crash, potentially disrupting business operations that rely on automated PDF processing.
Technical details
An infinite loop vulnerability (CWE-835) exists in pypdf prior to version 6.13.0. The issue is triggered when the library's writer component attempts to merge or process a PDF file containing malformed or specifically crafted outlines (bookmarks). An attacker can provide a malicious PDF that causes the application to enter a loop with an unreachable exit condition during text extraction or outline processing. This is a local attack vector requiring the library to process the attacker-supplied file. The vulnerability is resolved in version 6.13.0 by implementing checks to avoid infinite recursion and loops during these operations.
Affected products
- py-pdf pypdf < 6.13.0
Timeline
- 2026-06-05: patched: Version 6.13.0 released and PR #3830 merged.
- 2026-06-22: disclosed: CVE-2026-54531 published.