CVE-2026-54531: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-54531 Overview

CVE-2026-54531 is an infinite loop vulnerability in pypdf, a free and open-source pure-Python PDF library. An attacker can craft a malicious PDF that triggers an unbounded loop when merged into a writer object. The condition requires the target application to merge a file containing outlines into a pypdf writer. Exploitation results in denial of service through CPU exhaustion of the host process. The issue affects all versions of pypdf prior to 6.13.0 and is tracked under CWE-835: Loop with Unreachable Exit Condition. The maintainers resolved the flaw in release 6.13.0.

Critical Impact
Applications and automated pipelines using pypdf to merge untrusted PDF files containing outlines can be forced into an infinite loop, exhausting CPU and causing denial of service.

Affected Products

pypdf versions prior to 6.13.0
Python applications and services that merge untrusted PDF files into a pypdf writer
Document processing pipelines using pypdf outline-handling functionality

Discovery Timeline

2026-06-22 - CVE-2026-54531 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54531

Vulnerability Analysis

The vulnerability is a denial-of-service condition caused by an infinite loop in the outline-merging logic of pypdf. When a writer merges a PDF that contains crafted outline entries, the iteration over outline nodes never reaches a terminating condition. The processing thread continues consuming CPU cycles indefinitely.

The issue is local in attack vector because the malicious PDF must be supplied to a host process that calls into pypdf. In document-processing services that accept user-uploaded PDFs, the bug is reachable remotely through normal upload workflows. Confidentiality and integrity are not affected; only availability is impacted.

Root Cause

The root cause is CWE-835: a loop traversing outline structures lacks a reliable exit condition when the outline tree contains cyclic or malformed references. Crafted outline node links cause the traversal to revisit nodes indefinitely. Refer to the GitHub Security Advisory GHSA-m2v9-299j-rv96 and the fix in PR #3830 for the corrected traversal logic.

Attack Vector

An attacker crafts a PDF whose outline dictionary contains entries that form a cycle or otherwise prevent loop termination. The attacker delivers the file to a target application that calls a merge operation, such as PdfWriter.append() or equivalent outline-aware merge functions. When the writer processes the outlines of the malicious file, the thread enters an infinite loop. The vulnerability does not require authentication or user interaction beyond the normal file-handling workflow.

No verified public proof-of-concept code has been published. The vulnerability mechanism is documented in the GitHub Security Advisory and the release notes for pypdf 6.13.0.

Detection Methods for CVE-2026-54531

Indicators of Compromise

Python processes importing pypdf showing sustained 100% CPU usage on a single core after receiving a PDF for merging
Document-processing workers becoming unresponsive or being terminated by watchdog timers after handling PDFs containing outline entries
Task queue backlogs and timeout errors correlated with specific user-uploaded PDF files

Detection Strategies

Inventory dependencies across repositories and container images to identify pypdf versions below 6.13.0 using software composition analysis tooling
Instrument merge operations with execution-time limits and log files that exceed expected processing durations
Review PDF ingestion logs for files that triggered worker termination or restart events

Monitoring Recommendations

Track CPU utilization per worker process handling PDF input and alert on sustained saturation
Emit metrics for PDF merge operation duration and flag outliers for offline analysis
Forward application and container runtime logs to a central data lake for correlation with uploaded file hashes

How to Mitigate CVE-2026-54531

Immediate Actions Required

Upgrade pypdf to version 6.13.0 or later in all environments processing untrusted PDF files
Rebuild and redeploy container images and serverless functions that bundle the vulnerable library
Audit application code paths that call merge or append operations on user-supplied PDFs

Patch Information

The vulnerability is fixed in pypdf6.13.0. The corrected outline traversal is included in GitHub PR #3830. Release artifacts and changelog details are available in the pypdf 6.13.0 release notes. Install the fixed version with pip install --upgrade 'pypdf>=6.13.0'.

Workarounds

Enforce a hard execution timeout around merge operations using process-level or thread-level limits so an infinite loop is terminated
Disable outline merging in application code where outlines are not required for downstream output
Isolate PDF processing in sandboxed workers with strict CPU and wall-clock quotas to contain denial-of-service impact

bash

# Upgrade pypdf to the patched release
pip install --upgrade 'pypdf>=6.13.0'

# Verify the installed version
python -c "import pypdf; print(pypdf.__version__)"