CVE-2026-24688: Pypdf Library DOS Vulnerability

CVE-2026-24688 Overview

CVE-2026-24688 is an infinite loop vulnerability in pypdf, a free and open-source pure-Python PDF library. Attackers can craft a malicious PDF that triggers an infinite loop when an application accesses the document's outlines or bookmarks. The defect stems from missing cycle detection when traversing the outline tree, allowing cyclic references to consume CPU resources indefinitely. The issue affects all versions of pypdf prior to 6.6.2 and is tracked under CWE-835: Loop with Unreachable Exit Condition. Maintainers fixed the flaw in pypdf 6.6.2 through pull request #3610.

Critical Impact
Processing a malicious PDF causes the consuming application to enter an unbounded loop, exhausting CPU and producing a denial-of-service condition in any service that parses untrusted PDFs.

Affected Products

pypdf versions prior to 6.6.2
Python applications that call outline or bookmark retrieval APIs on untrusted PDFs
Downstream services and pipelines that bundle vulnerable pypdf releases

Discovery Timeline

2026-01-27 - CVE-2026-24688 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-24688

Vulnerability Analysis

The vulnerability lives in pypdf's outline traversal logic inside pypdf/_doc_common.py. PDF outlines form a tree of dictionary objects linked through /First, /Next, and /Parent references. The traversal routine recursively walked these references without tracking which nodes had already been visited. A crafted PDF whose outline nodes point back to a previously visited node creates a cycle. When an application requests the document outline, the parser revisits the same nodes indefinitely, blocking the thread that called the API.

The attack requires the consuming application to invoke outline or bookmark retrieval. PDF readers, indexing services, and document conversion pipelines routinely perform this operation, so a single weaponized file can stall ingestion workers.

Root Cause

The root cause is missing cycle detection [CWE-835] in the _get_outline method. The function recurses through outline nodes but never records previously visited object identifiers. Any cyclic graph that conforms to the PDF outline schema produces unbounded recursion or iteration.

Attack Vector

An attacker delivers a malicious PDF to a target that uses pypdf to enumerate outlines. Delivery vectors include file upload endpoints, email attachments processed by automated handlers, and document conversion services. The CVSS v4.0 vector indicates a local attack vector with low complexity and no privileges or user interaction required beyond submitting the file to the parser.

python

# Patch from pypdf 6.6.2 - adds a 'visited' set to detect cyclic outline references
# Source: https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1
         return self._get_outline()
 
     def _get_outline(
-        self, node: Optional[DictionaryObject] = None, outline: Optional[Any] = None
+        self,
+        node: Optional[DictionaryObject] = None,
+        outline: Optional[Any] = None,
+        visited: Optional[set[int]] = None,
     ) -> OutlineType:
         if outline is None:
             outline = []

The patch threads a visited set of object identifiers through recursive calls so that any node encountered a second time terminates traversal instead of recursing.

Detection Methods for CVE-2026-24688

Indicators of Compromise

Python worker processes pinned at 100% CPU while parsing a single PDF input
Application logs showing requests to outline or bookmark APIs that never return
PDF files whose /Outlines dictionary contains /First or /Next references that form a cycle
Unexpected timeouts or watchdog kills in document processing pipelines that use pypdf

Detection Strategies

Inventory Python dependencies and flag any pypdf release older than 6.6.2 using software composition analysis tools
Instrument PDF parsing workers with execution time limits and alert on outline retrieval calls exceeding a defined threshold
Scan stored PDFs for outline structures containing back-references that would create cycles

Monitoring Recommendations

Track CPU utilization and wall-clock duration of PDF processing jobs and alert on outliers
Log the pypdf version reported by pip show pypdf across build and runtime environments
Forward process telemetry from document ingestion services to a centralized log platform for correlation with file submissions

How to Mitigate CVE-2026-24688

Immediate Actions Required

Upgrade pypdf to version 6.6.2 or later in all production, staging, and developer environments
Audit applications that call outline or bookmark retrieval methods and enforce timeouts on those calls
Restrict PDF intake to authenticated and rate-limited endpoints while patches are rolling out

Patch Information

The fix is published in pypdf 6.6.2. See the GitHub release notes, the GitHub Security Advisory GHSA-2q4j-m29v-hq73, and the upstream commit for full details. Projects unable to upgrade can apply the diff from pull request #3610 manually.

Workarounds

Apply the changes from PR #3610 manually if upgrading is not yet feasible
Wrap calls to outline or bookmark APIs in a worker process with a strict CPU and wall-clock timeout
Reject or quarantine PDFs from untrusted sources until the library is updated

bash

# Upgrade pypdf to the patched release
pip install --upgrade "pypdf>=6.6.2"

# Verify the installed version
pip show pypdf | grep -i version