Executive brief
pypdf is a Python library used to read, write, and manipulate PDF documents. A flaw in its TreeObject.insert_child method allows an attacker to craft a malicious PDF that triggers an infinite loop when processed by applications using pypdf for writing or editing operations. This causes the application to hang and consume CPU resources until manually interrupted, disrupting any document processing workflows that depend on the library.
Technical details
The vulnerability is an infinite loop (CWE-835) in the TreeObject.insert_child method of pypdf. The root cause appears to be a circular reference or improper exit condition check when inserting child nodes into a PDF tree structure. An attacker can craft a PDF with malicious tree references that trigger this loop during write operations. The attack requires the vulnerable code path (TreeObject.insert_child) to be invoked, typically through PDF writing/editing operations, and does not require authentication or remote network access. Exploitation causes a denial of service by consuming system resources. The vulnerability has been patched in pypdf 6.16.0 and later; users unable to upgrade can apply the fix from PR #3964.
Affected products
- py-pdf pypdf < 6.16.0
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on GitHub Security Advisory Database
- 2026-08-13: patched: Fixed in pypdf 6.16.0
- 2026-09-01: advisory: Published to GitHub Advisory Database