CVE-2026-54530 Overview
CVE-2026-54530 is an infinite loop vulnerability [CWE-835] in pypdf, a free and open-source pure-Python PDF library widely used for parsing and processing PDF documents. Versions prior to 6.13.0 are affected. An attacker can craft a malicious PDF that triggers an infinite loop when the library extracts text in layout mode. The condition results in denial of service through CPU exhaustion on the host performing the extraction. The maintainers fixed the issue in version 6.13.0.
Critical Impact
A specially crafted PDF processed with layout-mode text extraction causes pypdf to enter an infinite loop, exhausting CPU resources and creating a local denial-of-service condition.
Affected Products
- pypdf versions prior to 6.13.0
- Python applications and services that ingest untrusted PDFs using pypdf layout-mode text extraction
- Downstream libraries and tools that wrap pypdf for document parsing
Discovery Timeline
- 2026-06-22 - CVE-2026-54530 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54530
Vulnerability Analysis
The flaw is classified as [CWE-835] Loop with Unreachable Exit Condition. It is triggered only when pypdf extracts text using layout mode, a feature that reconstructs spatial positioning of text from content streams. A malformed or adversarially structured PDF causes the extraction routine to repeatedly process content without advancing the loop termination state. The process consumes CPU indefinitely until terminated externally. Confidentiality and integrity are not affected; availability of the parsing process and the host is the sole impact. Exploitation requires the attacker to supply a PDF that is then processed locally by an application invoking the vulnerable code path.
Root Cause
The root cause is an unreachable exit condition in the layout-mode text extraction logic. The parser does not adequately validate or bound iteration over crafted content stream constructs, allowing input that never satisfies the loop termination criteria. Details are documented in the GitHub Security Advisory GHSA-52x6-gq3r-vpf4 and the associated pypdf Pull Request #3830.
Attack Vector
The attack vector is local. An attacker delivers a malicious PDF to a target system, for example through file uploads, email attachments, or document processing pipelines. When an application calls pypdf text extraction with layout mode enabled on the attacker-controlled file, the worker thread or process hangs. In server-side document processing services, repeated submissions can exhaust pooled workers and degrade service availability. No authentication or user interaction with the PDF content itself is required beyond triggering extraction.
No verified public proof-of-concept code is available. Technical details are described in the pypdf 6.13.0 release notes.
Detection Methods for CVE-2026-54530
Indicators of Compromise
- Python processes invoking pypdf that remain at sustained 100% CPU usage with no progress in output or logs.
- Document processing workers timing out or being terminated by watchdogs shortly after ingesting a specific PDF.
- Recurrence of stalls tied to the same PDF artifact or sender across processing attempts.
Detection Strategies
- Inventory Python dependencies and identify deployments of pypdf at versions below 6.13.0 using software composition analysis or pip list.
- Instrument PDF parsing routines with per-document timeouts and emit telemetry when the timeout fires, including file hash and source.
- Correlate high CPU events on document-processing hosts with PDF ingestion events in application logs.
Monitoring Recommendations
- Monitor CPU and runtime duration of processes that call pypdf.PdfReader text extraction in layout mode.
- Capture and retain hashes of PDFs that cause timeouts so they can be analyzed and blocklisted.
- Alert on anomalous spikes in worker restarts or queue backpressure in services that process user-submitted PDFs.
How to Mitigate CVE-2026-54530
Immediate Actions Required
- Upgrade pypdf to version 6.13.0 or later in all environments that parse untrusted PDFs.
- Audit applications and container images for transitive dependencies that pin older pypdf releases.
- Apply strict per-document execution timeouts and memory limits on any code path performing text extraction.
Patch Information
The vulnerability is fixed in pypdf6.13.0. Refer to the pypdf 6.13.0 release notes, the GitHub Security Advisory GHSA-52x6-gq3r-vpf4, and the corresponding Pull Request #3830 for the code-level fix.
Workarounds
- Avoid using layout-mode text extraction on untrusted PDFs until the upgrade is applied.
- Process PDFs in sandboxed subprocesses with hard CPU time limits, for example using resource.setrlimit with RLIMIT_CPU.
- Place PDF processing behind a job queue with strict per-task timeouts so a hanging extraction is killed and logged.
# Configuration example
pip install --upgrade 'pypdf>=6.13.0'
pip show pypdf | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
