CVE-2026-24688: pypdf Library DoS Vulnerability

CVE-2026-24688 Overview

CVE-2026-24688 is an Infinite Loop vulnerability affecting pypdf, a free and open-source pure-python PDF library. An attacker can craft a malicious PDF file that triggers an infinite loop when the application attempts to access outlines or bookmarks within the document. This vulnerability exists in versions prior to 6.6.2 and can lead to denial of service conditions by causing applications processing malicious PDFs to hang indefinitely.

Critical Impact

Applications using pypdf to process untrusted PDF files may become unresponsive when encountering specially crafted documents with cyclic references in outline structures, leading to denial of service.

Affected Products

• pypdf versions prior to 6.6.2
• Applications and services using vulnerable pypdf versions for PDF processing
• Python-based document management systems utilizing pypdf for outline/bookmark extraction

Discovery Timeline

• 2026-01-27 - CVE-2026-24688 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24688

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The issue resides in pypdf's outline retrieval functionality, specifically within the _get_outline() method in the _doc_common.py file. When processing PDF documents containing cyclic references in their bookmark/outline structures, the library fails to detect these circular references, causing the parsing function to loop indefinitely.

The local attack vector requires an attacker to provide a malicious PDF file to the target application. While this vulnerability does not compromise confidentiality or integrity, it poses a significant availability risk. Applications processing untrusted PDF files are particularly vulnerable, as a single malicious document can render the service unresponsive.

Root Cause

The root cause of CVE-2026-24688 is the absence of cyclic reference detection in the outline traversal logic. The _get_outline() method recursively traverses the PDF's outline dictionary structure without maintaining a record of previously visited nodes. When a PDF contains circular references in its outline hierarchy (where a child node references a parent or ancestor node), the traversal enters an infinite loop with no termination condition.

Attack Vector

The attack vector requires local access, meaning an attacker must be able to supply a malicious PDF file to the vulnerable application. Common attack scenarios include:

1. Uploading a crafted PDF to a web application that processes document outlines
2. Sending a malicious PDF via email to be processed by automated document handling systems
3. Providing the malicious file to any service that extracts bookmarks or navigation structures from PDF documents

The security patch implements cyclic reference detection by adding a visited parameter to track previously processed nodes:

         return self._get_outline()
 
     def _get_outline(
-        self, node: Optional[DictionaryObject] = None, outline: Optional[Any] = None
+        self,
+        node: Optional[DictionaryObject] = None,
+        outline: Optional[Any] = None,
+        visited: Optional[set[int]] = None,
     ) -> OutlineType:
         if outline is None:
             outline = []

Source: GitHub Commit Update

Detection Methods for CVE-2026-24688

Indicators of Compromise

• Application processes hanging indefinitely when processing specific PDF files
• Elevated CPU usage sustained at high levels during PDF outline extraction
• Timeout errors in services that process PDF bookmarks or navigation structures
• Memory consumption patterns indicating stuck processing loops

Detection Strategies

• Monitor Python processes using pypdf for abnormal execution times during PDF processing
• Implement timeout mechanisms around outline/bookmark extraction operations
• Audit application dependencies to identify vulnerable pypdf versions (< 6.6.2)
• Use SentinelOne's application control features to detect applications running outdated pypdf libraries

Monitoring Recommendations

• Set up alerting for Python processes consuming excessive CPU time during document processing
• Implement application-level timeouts for PDF parsing operations
• Monitor service availability and response times for PDF processing endpoints
• Review logs for repeated processing attempts on the same PDF file indicating potential exploitation

How to Mitigate CVE-2026-24688

Immediate Actions Required

• Upgrade pypdf to version 6.6.2 or later immediately
• Audit all Python applications and services for pypdf dependencies
• Implement processing timeouts as a temporary defensive measure for applications that cannot be immediately updated
• Review and restrict sources of PDF files being processed by vulnerable systems

Patch Information

The vulnerability has been addressed in pypdf version 6.6.2. The fix introduces cyclic reference detection by tracking visited nodes during outline traversal, preventing infinite loops when processing malicious PDFs with circular bookmark structures. Detailed information about the fix is available in the GitHub Pull Request #3610 and the GitHub Security Advisory GHSA-2q4j-m29v-hq73.

Workarounds

• Apply the changes from PR #3610 manually if upgrading to 6.6.2 is not immediately possible
• Implement timeout wrappers around pypdf outline/bookmark access functions
• Restrict PDF processing to trusted sources only until the patch can be applied
• Consider isolating PDF processing in sandboxed environments with resource limits

# Upgrade pypdf to patched version
pip install --upgrade pypdf>=6.6.2

# Verify installed version
pip show pypdf | grep Version