Pypdf
CVE-2026-27628
HIGH
GHSA-2rw7-x74f-jg35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with circular references
-
ExploitSubmit file to pypdf parser
-
ExecutionTrigger infinite loop in PDF processing
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against pypdf versions prior to 6.7.2 when processing untrusted PDF files. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this flaw, an infinite loop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Pypdf versions up to 6.7.2 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-835: Loop with Unreachable Exit Condition (Infinite Loop)) affects Pypdf. pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.
Know when Pypdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.
Executive ViewAI
PyPDF library versions up to 6.7.2 contain an infinite loop vulnerability that could allow attackers to cause denial of service against applications processing PDF files. Organizations using affected versions risk service unavailability and resource exhaustion if exploited.
Apply vendor patch. If immediate patching is not feasible: implement input validation to reject suspicious PDF files, deploy rate limiting on PDF processing endpoints, isolate PDF processing services with resource limits (CPU/memory quotas), and monitor for abnormal process behavior indicating infinite loops.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-bas
Infinite loop denial-of-service in pypdf prior to 6.13.1 allows an attacker to hang any process that merges a crafted PD
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. Rat
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. Rat
pypdf is an open source, pure-python PDF library. Rated medium severity (CVSS 5.5), this vulnerability is no authenticat
Resource exhaustion in pypdf prior to 6.16.1 allows an attacker who can supply a crafted PDF to cause denial of service
Memory exhaustion in pypdf versions prior to 6.19.0 allows a remote, unauthenticated attacker to make an application una
Denial of service in pypdf versions prior to 6.19.0 allows an unauthenticated remote attacker to pin a PDF-processing wo
Denial of service in pypdf versions prior to 6.19.0 allows remote, unauthenticated attackers to exhaust application CPU
Denial of service in pypdf before 6.18.1 lets a crafted PDF drive the library's FlateDecode recovery path into inefficie
Memory exhaustion in pypdf versions prior to 6.18.1 lets a crafted PDF force the library to allocate and process far mor
Memory exhaustion in pypdf versions prior to 6.18.1 allows unauthenticated remote attackers to crash or degrade any appl
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB