CVE-2026-54651: pypdf: Possible infinite loop when processing threads/articles in writer
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer.
Patches
This has been fixed in pypdf==6.13.1.
Workarounds
If users cannot upgrade yet, consider applying the changes from PR #3839.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.13.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.13.1 - Configuration
If you cannot upgrade yet, apply the changes from PR [#3839] to address the infinite loop when processing threads/articles in a writer.
pypdf Infinite loop fix when processing threads/articles in writer = Apply changes from PR [#3839]
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54651?
CVE-2026-54651 has a risk rating of 23.
How do I fix CVE-2026-54651?
To resolve CVE-2026-54651, upgrade to pypdf version 6.13.1 or later.
What type of application is affected by CVE-2026-54651?
CVE-2026-54651 affects the pypdf library, which is a PDF manipulation tool in Python.
What can an attacker do with CVE-2026-54651?
An attacker can exploit CVE-2026-54651 to create a PDF that causes an infinite loop during processing.
In which version of pypdf was CVE-2026-54651 introduced?
CVE-2026-54651 was present in versions prior to 6.13.1 of the pypdf library.