CVE-2026-41168: pypdf Library DOS Vulnerability

CVE-2026-41168 Overview

pypdf is a free and open-source pure-python PDF library used for reading, manipulating, and creating PDF files. A denial of service vulnerability exists in versions prior to 6.10.1 that allows an attacker to craft a malicious PDF document which causes excessive runtime consumption when processed. The vulnerability is triggered through specially crafted cross-reference streams containing incorrect large /Size values or object streams with incorrect large /N values.

Critical Impact
An attacker can craft a malicious PDF file that causes application hangs or resource exhaustion when processed by pypdf, potentially impacting availability of services that rely on PDF processing.

Affected Products

pypdf versions prior to 6.10.1
Applications and services that use pypdf for PDF processing
Python-based document processing pipelines utilizing vulnerable pypdf versions

Discovery Timeline

2026-04-22 - CVE CVE-2026-41168 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41168

Vulnerability Analysis

This vulnerability is classified as CWE-834 (Excessive Iteration), a type of algorithmic complexity attack that falls under the Denial of Service category. The issue arises when pypdf processes PDF files containing malformed cross-reference (xref) streams or object streams with intentionally inflated size parameters.

When pypdf encounters a cross-reference stream with an excessively large /Size value, or an object stream with an abnormally large /N value, the library attempts to process these inflated parameters without proper validation. This results in extensive iteration loops and memory allocation attempts that can cause significant CPU consumption and potentially lead to application hangs or crashes.

The network-accessible nature of this vulnerability means that any web application, API endpoint, or service that accepts PDF uploads and processes them using vulnerable pypdf versions is at risk. An attacker requires no authentication or special privileges to exploit this vulnerability—they simply need to submit a crafted PDF file.

Root Cause

The root cause lies in insufficient validation of the /Size parameter in cross-reference streams and the /N parameter in object streams within the PDF parsing logic. Prior to version 6.10.1, pypdf did not properly bounds-check these values before initiating processing loops, allowing attackers to force excessive iterations through crafted parameter values.

Attack Vector

The attack vector is network-based, requiring no user interaction beyond the initial PDF file upload or submission. An attacker crafts a PDF document containing:

Cross-reference streams with intentionally large /Size values that do not correspond to the actual number of objects in the PDF
Object streams with inflated /N values that exceed the actual object count

When a vulnerable pypdf instance attempts to parse such a document, it enters lengthy processing loops attempting to handle the declared (but non-existent) objects, leading to denial of service through resource exhaustion.

The vulnerability mechanism involves malformed PDF structure parameters that trigger excessive iteration. When pypdf reads the cross-reference stream, it trusts the /Size value to allocate resources and iterate over expected objects. Similarly, object streams declare their object count via /N. By providing artificially large values for these parameters, an attacker forces the library into computationally expensive loops. For detailed technical implementation, refer to the GitHub Security Advisory GHSA-jj6c-8h6c-hppx.

Detection Methods for CVE-2026-41168

Indicators of Compromise

Unusual CPU utilization spikes when processing PDF files
Application timeouts or hangs during PDF parsing operations
Memory usage anomalies in PDF processing services
PDF files with abnormally large /Size or /N parameters in stream dictionaries

Detection Strategies

Implement file analysis to detect PDF documents with suspicious cross-reference stream parameters
Monitor application performance metrics during PDF processing to identify resource exhaustion patterns
Deploy application-level timeouts for PDF parsing operations to prevent indefinite hangs
Use static analysis tools to scan PDF files for malformed structure parameters before processing

Monitoring Recommendations

Enable logging for PDF processing duration and resource consumption
Set up alerts for PDF processing operations exceeding expected time thresholds
Monitor memory and CPU utilization patterns for services handling PDF uploads
Track and analyze failed or timed-out PDF processing attempts

How to Mitigate CVE-2026-41168

Immediate Actions Required

Upgrade pypdf to version 6.10.1 or later immediately
Implement processing timeouts for all PDF parsing operations as a defense-in-depth measure
Review and audit all applications and services that use pypdf for PDF processing
Consider implementing file size and complexity limits for PDF uploads

Patch Information

The vulnerability has been fixed in pypdf version 6.10.1. The fix introduces proper validation of /Size and /N parameters to prevent excessive iteration. Organizations should update their pypdf installations immediately.

For more information, see:

Workarounds

Apply the changes from the security patch manually if immediate upgrade is not possible
Implement application-level timeouts for PDF processing to limit resource exhaustion impact
Use input validation to reject PDF files with suspicious stream parameters before pypdf processing
Consider sandboxing PDF processing operations to limit resource consumption

bash

# Upgrade pypdf to patched version
pip install --upgrade pypdf>=6.10.1

# Verify installed version
pip show pypdf | grep Version