CVE-2026-27024: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-27024 Overview

CVE-2026-27024 is a Denial of Service vulnerability affecting pypdf, a free and open-source pure-python PDF library. Prior to version 6.7.1, an attacker can craft a malicious PDF document that triggers an infinite loop when the library attempts to access the children of a TreeObject, such as when processing document outlines. This vulnerability can cause applications using pypdf to hang indefinitely, consuming system resources and rendering the application unresponsive.

Critical Impact

Maliciously crafted PDF files can cause applications using pypdf to enter an infinite loop, leading to Denial of Service conditions that affect application availability and system resources.

Affected Products

• pypdf versions prior to 6.7.1
• Applications and services using vulnerable pypdf versions for PDF processing
• Python-based PDF parsing and manipulation tools built on pypdf

Discovery Timeline

• 2026-02-20 - CVE-2026-27024 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-27024

Vulnerability Analysis

This vulnerability (CWE-835: Loop with Unreachable Exit Condition) exists in pypdf's handling of TreeObject structures within PDF documents. When accessing child elements of a TreeObject, such as document outlines or bookmarks, the library iterates through linked nodes without verifying whether a cycle exists in the tree structure. A maliciously crafted PDF can contain circular references in its outline structure, causing the iteration to continue indefinitely without ever reaching an exit condition.

The attack requires local access, as an attacker must convince a user or automated system to process a specially crafted PDF file. Once processed, the vulnerable code path iterates through the tree structure following /First and /Next references without cycle detection, resulting in an infinite loop that consumes CPU resources and blocks application execution.

Root Cause

The root cause is the absence of cycle detection when traversing TreeObject children in pypdf's _data_structures.py module. The original implementation follows object references through the tree structure without maintaining a record of previously visited nodes. When a circular reference exists (e.g., a child node's /Next reference points back to an ancestor), the traversal never terminates because there is no mechanism to detect that a node has already been visited.

Attack Vector

The attack vector requires an attacker to craft a PDF document containing a circular reference in its outline tree structure. When a victim application processes this PDF and accesses outline-related functionality (such as extracting bookmarks or navigating the document structure), the vulnerable code path is triggered. The attack is local in nature, requiring the malicious PDF to be opened or processed by an application using a vulnerable pypdf version.

# Security patch from pypdf/generic/_data_structures.py
# Source: https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295

             return
 
         child_ref = self[NameObject("/First")]
+        last = self[NameObject("/Last")]
         child = child_ref.get_object()
+        visited: set[int] = set()
         while True:
+            child_id = id(child)
+            if child_id in visited:
+                logger_warning(f"Detected cycle in outline structure for {child}", __name__)
+                return
+            visited.add(child_id)
+
             yield child
-            if child == self[NameObject("/Last")]:
+
+            if child == last:
                 return
             child_ref = child.get(NameObject("/Next"))  # type: ignore
             if is_null_or_none(child_ref):

Source: GitHub Commit bd2f6d0

Detection Methods for CVE-2026-27024

Indicators of Compromise

• Application processes hanging indefinitely when processing specific PDF files
• Elevated CPU usage sustained at high levels during PDF processing operations
• Python processes consuming excessive CPU without completing PDF-related tasks
• Application timeouts or failures when handling user-uploaded PDF documents

Detection Strategies

• Monitor Python application processes for unusual CPU consumption patterns during PDF processing
• Implement application-level timeouts for PDF parsing operations to detect potential infinite loop conditions
• Review application dependency manifests to identify pypdf versions prior to 6.7.1
• Use software composition analysis (SCA) tools to scan for vulnerable pypdf installations

Monitoring Recommendations

• Configure process monitoring to alert on sustained high CPU usage by Python applications handling PDFs
• Implement watchdog timers for PDF processing operations to terminate hung processes
• Enable application logging to capture PDF processing durations and identify anomalous behavior
• Monitor for recurring processing failures or timeouts associated with specific PDF files

How to Mitigate CVE-2026-27024

Immediate Actions Required

• Upgrade pypdf to version 6.7.1 or later immediately
• Audit all applications and services using pypdf to identify vulnerable deployments
• Implement input validation to reject PDF files from untrusted sources until patching is complete
• Configure process resource limits to prevent runaway CPU consumption from affecting system stability

Patch Information

The vulnerability has been fixed in pypdf version 6.7.1. The patch introduces cycle detection by maintaining a set of visited node IDs during TreeObject traversal. When a previously visited node is encountered, the function logs a warning and returns gracefully instead of continuing the infinite loop. The fix is available in the GitHub Release 6.7.1 and can be applied by updating pypdf via pip. Additional details are available in the GitHub Security Advisory GHSA-996q-pr4m-cvgq.

Workarounds

• Implement application-level timeouts to terminate PDF processing operations that exceed expected duration
• Isolate PDF processing in separate worker processes with resource limits to contain potential DoS impact
• Restrict PDF uploads to authenticated users and implement rate limiting
• Use containerization or sandboxing to limit the blast radius of runaway processes

# Configuration example
# Upgrade pypdf to the patched version
pip install --upgrade pypdf>=6.7.1

# Verify installed version
pip show pypdf | grep Version

# For requirements.txt, specify minimum version
echo "pypdf>=6.7.1" >> requirements.txt