pypdf, a pure-Python PDF library, contains an infinite-loop vulnerability triggered when loading a PDF with circular /Prev entries in its cross-reference streams. An attacker who supplies such a crafted PDF can cause the library to loop indefinitely while reading the file, exhausting system resources and resulting in a denial-of-service condition. The weakness corresponds to CWE‑835 and only requires the ability to load a malicious PDF; no elevated privileges or local resources are needed.

This issue affects any deployment of py-pdf:pypdf prior to version 6.7.2. Users running earlier releases, including those integrating pypdf into custom applications or data pipelines, are vulnerable whenever they process PDFs that may contain circular cross-reference references.

The vulnerability has a low CVSS score of 1.2 and an EPSS below 1 %, indicating rare exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote file load, as the malicious PDF must be loaded by the application; thus, exposure is limited to environments where untrusted PDFs are processed. Remedying the issue mitigates the risk of a denial-of-service event.