CVE-2026-33699: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-33699 Overview

CVE-2026-33699 is a Denial of Service vulnerability affecting pypdf, a free and open-source pure-Python PDF library. This vulnerability allows an attacker to craft a malicious PDF file that triggers an infinite loop when processed by vulnerable versions of pypdf in non-strict mode, potentially causing resource exhaustion and service disruption.

Critical Impact

Attackers can cause application hangs and denial of service by supplying specially crafted PDF files to applications using pypdf in non-strict mode.

Affected Products

• pypdf versions prior to 6.9.2
• Applications using pypdf with non-strict parsing mode enabled
• Python environments running vulnerable pypdf versions

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33699 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33699

Vulnerability Analysis

This vulnerability falls under CWE-835 (Loop with Unreachable Exit Condition), commonly known as an Infinite Loop vulnerability. The flaw exists in how pypdf handles certain PDF structures when operating in non-strict parsing mode.

When pypdf processes a specially crafted PDF document with non-strict mode enabled, the parser can enter an infinite loop condition. This occurs because the vulnerable code path lacks proper termination checks for certain malformed PDF object structures. The infinite loop causes the application to hang indefinitely, consuming CPU resources until the process is manually terminated or the system becomes unresponsive.

The vulnerability is network-exploitable since attackers can deliver malicious PDF files through various vectors including email attachments, web uploads, or API endpoints that process user-supplied PDF documents.

Root Cause

The root cause of this vulnerability is insufficient input validation in pypdf's PDF parsing logic when operating in non-strict mode. Non-strict mode is designed to be more lenient when processing malformed or non-compliant PDF files, which inadvertently allows certain malicious structures to bypass normal parsing safeguards.

The vulnerable code path fails to implement proper loop termination conditions when iterating through PDF object references, allowing an attacker to construct circular references or specially crafted structures that cause the parser to loop indefinitely.

Attack Vector

The attack vector for CVE-2026-33699 involves delivering a maliciously crafted PDF file to a target application that uses pypdf for PDF processing. The attack is particularly effective against:

• Web applications that accept PDF uploads and process them server-side
• Document management systems using pypdf for PDF parsing
• API services that process PDF content from untrusted sources
• Email attachment scanners or preview generators

For successful exploitation, the target application must read the malicious PDF using non-strict mode. When processed, the crafted PDF causes the parsing thread to enter an infinite loop, consuming CPU resources and potentially causing the entire application or service to become unresponsive.

The vulnerability can be exploited remotely without authentication if the target application accepts PDF files from untrusted sources. For more technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33699

Indicators of Compromise

• Unusual CPU consumption by Python processes running pypdf
• Application threads or processes that become unresponsive when processing PDF files
• Timeout errors or hung requests in PDF processing workflows
• Log entries indicating prolonged PDF parsing operations without completion

Detection Strategies

• Monitor for abnormal CPU utilization spikes in applications that process PDF files
• Implement request timeout monitoring to detect hung PDF processing operations
• Review application logs for PDF parsing operations that fail to complete within expected timeframes
• Audit dependencies to identify pypdf versions prior to 6.9.2

Monitoring Recommendations

• Enable process-level CPU monitoring for applications using pypdf
• Implement watchdog timers for PDF processing operations with defined timeout thresholds
• Configure alerting for processing threads that exceed normal execution duration
• Deploy software composition analysis tools to track pypdf versions across your environment

How to Mitigate CVE-2026-33699

Immediate Actions Required

• Upgrade pypdf to version 6.9.2 or later immediately
• Audit all applications and services that depend on pypdf for vulnerable versions
• Consider temporarily disabling PDF processing from untrusted sources until patching is complete
• Implement timeout mechanisms for PDF processing operations as an additional safeguard

Patch Information

The pypdf development team has addressed this vulnerability in version 6.9.2. Users should upgrade to this version or later to remediate the infinite loop vulnerability. The fix is available through standard Python package managers.

For detailed information about the patch, see the GitHub Pull Request and download the patched version from the GitHub Release page.

Workarounds

• Use strict parsing mode instead of non-strict mode when processing untrusted PDF files
• Implement processing timeouts to kill hung operations after a defined threshold
• Validate and sanitize PDF files using alternative tools before processing with pypdf
• Apply the patch changes manually if immediate upgrade is not possible, as recommended in the security advisory

# Upgrade pypdf to patched version
pip install --upgrade pypdf>=6.9.2

# Verify installed version
pip show pypdf | grep Version

# Alternative: Install specific patched version
pip install pypdf==6.9.2