Is there a public PoC exploit available for CVE-2026-54651?

Yes, a public proof-of-concept exploit is available for CVE-2026-54651. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-54651?

Yes, a patch is available for CVE-2026-54651. Update the affected software to the latest version immediately.

pypdf CVE-2026-54651

Q: What is the CVSS score of CVE-2026-54651?

CVE-2026-54651 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38358 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-06-22 GitHub_M

GHSA-g9xf-7f8q-9mcj

Denial Of Service Python Red Hat Pypdf Suse Py Pdf

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Attacker delivers a crafted file processed locally by pypdf with no required privileges or separate user interaction; only availability is impacted via process hang.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 21:23 vuln.today

Analysis Generated

Jun 22, 2026 - 21:23 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on pypdf (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.13.1.

DescriptionCVE.org

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

AnalysisAI

Infinite loop denial-of-service in pypdf prior to 6.13.1 allows an attacker to hang any process that merges a crafted PDF containing cyclic article/thread structures. The vulnerability exists in the _add_articles_thread() method of _writer.py, which traversed PDF article bead linked-list structures without cycle detection, permitting a self-referential /N (Next) pointer chain to create an irrecoverable loop. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream PR diff publicly discloses the precise triggering structure, lowering the bar for exploitation against vulnerable merge pipelines.

Technical ContextAI

pypdf (CPE: cpe:2.3:a:py-pdf:pypdf) is a pure-Python library for reading, writing, and merging PDF files. The PDF specification supports 'articles' - named reading sequences composed of linked 'bead' dictionaries connected via /N (Next) and /P (Previous) pointers. The _add_articles_thread() method in pypdf/_writer.py iterated through these bead dictionaries following /N pointers to clone and register each article during a merge operation. The method contained no visited-node tracking, embodying CWE-835 (Loop with Unreachable Exit Condition): a crafted PDF where the last bead's /N pointer references an earlier bead creates a circular linked list that the traversal loop can never exit. The fix (PR #3839) introduces a visited: set[int] tracking id(current_article) and raises LimitReachedError upon detecting a revisited node.

RemediationAI

Upgrade pypdf to version 6.13.1 or later, available via PyPI (pip install --upgrade pypdf) and documented at https://github.com/py-pdf/pypdf/releases/tag/6.13.1. If an immediate upgrade is not feasible, the most actionable compensating control is to wrap all PdfWriter.merge() calls (or equivalent) in a subprocess or thread with a strict wall-clock timeout and kill the worker if it exceeds an expected processing duration - this bounds the DoS impact to a single request rather than a persistent hang. Alternatively, pre-screen incoming PDFs to detect the presence of /Threads entries in the document catalog before merging; rejecting or stripping thread structures from untrusted inputs eliminates the vulnerable code path entirely, though it may affect legitimate article-threaded documents. Do not rely on file size limits alone, as the cyclic structure is compact and size-based filters will not detect it.