What is the CVSS score of CVE-2026-27628?

CVE-2026-27628 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-27628?

PyPDF library versions up to 6.7.2 contain an infinite loop vulnerability that could allow attackers to cause denial of service against applications processing PDF files.. A patch is available.

How to fix or mitigate CVE-2026-27628?

Within 24 hours: Identify all systems and applications using PyPDF versions ≤6.7.2 through dependency scanning and asset inventory. Within 7 days: Upgrade PyPDF to version 6.7.3 or later across development, staging, and production environments; prioritize customer-facing and critical services first. Within 30 days: Validate patch deployment, conduct regression testing, and document remediation completion in your vulnerability management system.

Python CVE-2026-27628

HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-02-25 security-advisories@github.com

GHSA-2rw7-x74f-jg35

Python Pypdf Red Hat Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 27, 2026 - 20:21 nvd

Patch available

CVE Published

Feb 25, 2026 - 03:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on pypdf (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.7.2.

DescriptionGitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

AnalysisAI

Pypdf versions up to 6.7.2 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-835: Loop with Unreachable Exit Condition (Infinite Loop)) affects Pypdf. pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2017-9462 HIGH Act Now POC

8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

CVE-2026-33017 CRITICAL Act Now POC

9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2026-55255 HIGH Act Now POC

8.4 Jun 19

Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

8.6

CVE-2017-16944 HIGH POC

7.5

CVE-2022-0778 HIGH POC

7.5

CVE-2024-43366 CRITICAL POC

9.1

CVE-2026-25533 HIGH POC

8.8

CVE-2018-8002 HIGH POC

8.8

CVE-2017-15223 MEDIUM POC

5.3

CVE-2025-71329 HIGH POC

8.7

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

CVE-2026-27628 vulnerability details – vuln.today

Back

Python CVE-2026-27628

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Python

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code