CVE-2026-24688: pypdf Infinite Loop Vulnerability in PDF Outline Processing
Summary
CVE-2026-24688: pypdf has possible Infinite Loop when processing outlines/bookmarks. Affects pypdf versions < 6.6.2. Fixed in 6.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a popular Python library used for manipulating PDF files. It allows users to create, modify, and extract information from PDFs, making it a valuable tool for developers working with document processing. However, it has been found to have a vulnerability that can lead to an infinite loop when processing outlines or bookmarks in specially crafted PDF files.
Vulnerability Detail
The vulnerability arises from the way pypdf handles outlines and bookmarks within PDF documents. An attacker can exploit this flaw by crafting a malicious PDF that triggers an infinite loop during processing. This can lead to denial of service, as the application may become unresponsive while attempting to process the malformed PDF. The issue is classified under CWE-835, which pertains to infinite loops in software.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.6.2
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can apply the changes from pull request #3610 on GitHub. This involves manually modifying the code to handle outlines and bookmarks more safely. The specific changes can be found in the pull request discussion.
Conclusion
The pypdf library has a vulnerability that can lead to an infinite loop when processing certain PDF outlines or bookmarks. Users are advised to upgrade to version 6.6.2 to mitigate this risk. For those unable to upgrade immediately, applying the changes from the relevant pull request can serve as a temporary workaround.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score for this vulnerability is 5.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is denial of service, as the application may enter an infinite loop and become unresponsive when processing a malicious PDF.
Yes, you can apply the changes from pull request #3610 as a temporary workaround until you can upgrade to the patched version.
You can find more information about pypdf and its features on its official GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
