CVE-2026-27628: pypdf Infinite Loop Vulnerability in Circular /Prev Entries
Summary
CVE-2026-27628: pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams. Affects pypdf versions < 6.7.2. Fixed in 6.7.2. How to fix ↓
Also tracked for
The same CVE-2026-27628 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a popular Python library used for manipulating PDF files. It allows users to create, modify, and extract information from PDFs. The library is widely utilized due to its ease of use and comprehensive functionality. However, it has been identified that pypdf is vulnerable to a specific issue where it can enter an infinite loop when processing circular /Prev entries in cross-reference streams, potentially leading to denial of service.
Vulnerability Detail
The vulnerability arises from the way pypdf handles circular references in PDF files. An attacker can craft a malicious PDF that exploits this flaw, causing the library to enter an infinite loop during the loading process. This can lead to significant resource consumption and may render the application unresponsive, affecting any system that attempts to read the compromised PDF file.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.2
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can apply the changes from the pull request #3655 on GitHub. This involves modifying the code to handle circular references more effectively. Specific code changes can be found in the pull request linked here: https://github.com/py-pdf/pypdf/pull/3655.
Conclusion
The pypdf library has a vulnerability (CVE-2026-27628) that can lead to an infinite loop when processing certain PDF files. Users are advised to upgrade to version 6.7.2 to mitigate this risk. If upgrading is not possible, a workaround is available through code modifications.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-27628 is a vulnerability in the pypdf library that can cause an infinite loop when loading certain PDF files with circular /Prev entries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to denial of service, as the application may become unresponsive when attempting to process a malicious PDF.
Yes, the vulnerability has been fixed in pypdf version 6.7.2. Users are encouraged to upgrade to this version.
If an upgrade is not possible, consider applying the changes from pull request #3655 as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
