CVE-2026-54651

Analyzed Analyzed - Analysis Complete

Infinite Loop in PyPDF Due to Malicious PDF Merge

Publication date: 2026-06-22

Last updated on: 2026-06-24

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-24

Generated

2026-07-13

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2026-54651

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.13.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.13.1, an attacker could craft a specially designed PDF file that, when merged with a file containing threads or articles into a writer, causes the process to enter an infinite loop.

This infinite loop can disrupt normal operations and is fixed in version 6.13.1 of pypdf.

Impact Analysis

The primary impact of this vulnerability is that it can cause an infinite loop during PDF processing when merging certain crafted PDF files. This can lead to denial of service by making the application or system using pypdf unresponsive or stuck.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the pypdf library to version 6.13.1 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70