CVE-2026-54651: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-54651 Overview

CVE-2026-54651 is a denial of service vulnerability in pypdf, a pure-Python PDF library used to read, write, and merge PDF documents. Versions prior to 6.13.1 contain an infinite loop condition triggered when merging a crafted PDF containing threads or articles into a writer. An attacker who controls a PDF processed by a vulnerable application can force the consuming process to consume CPU resources indefinitely. The maintainers fixed the issue in pypdf 6.13.1. The flaw is classified under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
A maliciously crafted PDF processed by pypdf's merge functionality triggers an infinite loop, causing CPU exhaustion and denial of service in any application that merges untrusted PDFs containing threads or articles.

Affected Products

pypdf versions prior to 6.13.1
Python applications using pypdf's writer/merge functionality
Document processing pipelines that ingest untrusted PDFs

Discovery Timeline

2026-06-22 - CVE-2026-54651 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54651

Vulnerability Analysis

The vulnerability is an infinite loop condition that occurs during PDF merge operations. pypdf supports composing PDFs by reading source documents and writing their structures into an output via a writer object. When a source PDF contains thread or article structures, pypdf traverses these objects to copy them into the destination. A crafted PDF can present thread or article entries whose traversal logic never reaches its termination condition, causing the merge routine to spin indefinitely.

The consequence is single-vector resource exhaustion. The process consumes a CPU core, the merge call never returns, and any caller blocking on it hangs. In server contexts, repeated submissions can exhaust worker pools and degrade availability. The attack does not yield code execution, data disclosure, or integrity loss — impact is limited to availability of the host process.

Root Cause

The root cause is missing termination logic in the code path that copies PDF threads and articles during a write or merge operation. PDF thread and article dictionaries can reference other objects in chains. Without guards against cycles or malformed references, a self-referential or otherwise malformed chain causes the traversal loop to never satisfy its exit condition. See the fix pull request for the corrected traversal logic.

Attack Vector

Exploitation requires an attacker to supply a crafted PDF to an application that uses pypdf to merge files containing threads or articles into a writer. The attack vector is local in CVSS terms because pypdf is a library and the malicious input must be passed to it by a calling process. However, any application that accepts user-uploaded PDFs and runs them through PdfWriter.append, PdfWriter.merge, or equivalent operations is exposed to remote submission of the malicious file. No authentication or user interaction with pypdf itself is required once the file is queued for processing.

The vulnerability is described in prose only — no verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-g9xf-7f8q-9mcj for upstream details.

Detection Methods for CVE-2026-54651

Indicators of Compromise

Python worker processes pinned at 100% CPU on a single core while executing pypdf merge or append operations.
Long-running or never-completing PDF processing jobs in queues that previously had bounded execution times.
Stack traces or thread dumps repeatedly showing frames inside pypdf's thread or article handling code paths.

Detection Strategies

Monitor pypdf package versions across Python environments and flag any installation below 6.13.1.
Instrument PDF processing code paths with execution timeouts and log timeout events with the originating file hash.
Inspect ingested PDFs for unusually structured /Threads or /Articles entries prior to passing them to pypdf.

Monitoring Recommendations

Track CPU utilization and wall-clock duration per PDF processing job; alert on outliers exceeding a defined threshold.
Capture the SHA-256 of every PDF processed by pypdf to enable retrospective hunting once a malicious sample is identified.
Audit dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) for pinned pypdf versions vulnerable to CVE-2026-54651.

How to Mitigate CVE-2026-54651

Immediate Actions Required

Upgrade pypdf to version 6.13.1 or later in all environments that perform PDF merge or write operations.
Inventory applications, scripts, and container images that bundle pypdf and prioritize those exposed to untrusted PDF input.
Add execution timeouts around pypdf merge calls so that malicious files cannot hang worker processes indefinitely.

Patch Information

The fix is available in pypdf 6.13.1, released by the maintainers. Refer to the pypdf 6.13.1 release notes and the GitHub Security Advisory for the full advisory and the merge fix in pull request #3839.

Workarounds

If immediate upgrade is not possible, avoid merging PDFs from untrusted sources or strip /Threads and /Articles entries before processing.
Execute pypdf merge operations in sandboxed child processes with hard CPU and wall-clock limits enforced by the operating system.
Place a size and content validation layer in front of pypdf to reject PDFs whose structure indicates suspicious thread or article chains.

bash

# Configuration example: upgrade pypdf and enforce a minimum version
pip install --upgrade 'pypdf>=6.13.1'

# Verify the installed version
python -c "import pypdf; print(pypdf.__version__)"

# Pin the safe version in requirements.txt
echo 'pypdf>=6.13.1' >> requirements.txt