CVE-2026-54651

pypdf: Possible infinite loop when processing threads/articles in writer

View on CVE.org
Published Jun 22, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

Analysis

AI-generated

Technical impact

A flaw in early releases of the pypdf library exposes a logic error that can cause an infinite loop during PDF processing. The bug occurs when a PDF that contains threads or articles is merged into a writer via the library’s merge function. The loop never terminates, resulting in excessive CPU consumption and eventual loss of responsiveness for the host application that is performing the merge.

Affected Systems

The vulnerability affects the py-pdf pypdf library in any version prior to 6.13.1. Updating to version 6.13.1 or later provides the fix that removes the infinite loop condition.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the infinite loop by delivering a specially crafted PDF file to any process that invokes the merge operation. The attack vector may be local if the process runs on the attacker’s machine or remote if the application exposes a PDF handling endpoint. The impact is restricted to resource exhaustion and service denial; there is no code execution or data compromise.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the pypdf library to version 6.13.1 or later
  • Configure the application to validate PDFs and reject files that contain threads or articles before invoking the merge operation
  • Apply CPU or thread limits around PDF processing functions to prevent long‑running loops from exhausting system resources

Generated by OpenCVE AI on June 22, 2026 at 23:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-g9xf-7f8q-9mcj pypdf: Possible infinite loop when processing threads/articles in writer
History
Type Values Removed Values Added
CPEs cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*
Vendors & Products Pypdf Project
Pypdf Project pypdf
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Py-pdf
Py-pdf pypdf
Vendors & Products Py-pdf
Py-pdf pypdf
Type Values Removed Values Added
Description pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.
Title pypdf: Possible infinite loop when processing threads/articles in writer
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jun 23, 2026, 12:10 PM
Reserved
Jun 15, 2026, 8:16 PM

View source JSON

Updated
Jun 23, 2026, 12:10 PM

JSON

Status
Analyzed
Published
Jun 22, 2026, 9:16 PM
Modified
Nov 2, 2026, 4:06 PM

View source JSON

Severity
Moderate
Public date
Jun 22, 2026, 8:28 PM

View source Bugzilla JSON

Updated
Jun 23, 2026, 12:15 AM

JSON