CVE-2026-27628: pypdf Infinite Loop Vulnerability in PDF Processing
Summary
CVE-2026-27628: pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams. Affects pypdf versions < 6.7.2. Fixed in 6.7.2. How to fix ↓
Also tracked for
The same CVE-2026-27628 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a free and open-source pure-Python library designed for working with PDF files. It allows users to create, manipulate, and extract information from PDFs. The library is widely used due to its ease of use and flexibility. However, prior to version 6.7.2, pypdf had a vulnerability that could lead to an infinite loop when processing circular /Prev entries in cross-reference streams, potentially causing denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2026-27628 arises from the way pypdf handles certain PDF structures. An attacker can craft a malicious PDF file that exploits this flaw, leading to an infinite loop during the loading process. This situation can result in the application becoming unresponsive, thereby affecting the user experience and potentially leading to denial of service. The vulnerability is classified under CWE-835, which pertains to infinite loops in software.
How To Fix
Minimum fixed version
6.7.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may apply a manual patch to the affected code. However, it is highly recommended to update to the fixed version instead of relying on a manual patch.
Conclusion
In summary, CVE-2026-27628 is a significant vulnerability in the pypdf library that can lead to an infinite loop when processing certain PDF files. Users are encouraged to update to version 6.7.2 or later to mitigate this risk. For real-time monitoring of vulnerabilities, consider using Vulert, which can alert you to issues without requiring code access.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-27628 is a vulnerability in the pypdf library that can lead to an infinite loop when processing certain PDF files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for vulnerabilities without needing to sign up.
The main consequence is that an application using an affected version of pypdf may become unresponsive, leading to a denial of service.
You can update pypdf by running the command 'pip install --upgrade pypdf' in your terminal.
Yes, there is a manual patch available, but it is recommended to update to version 6.7.2 or later for a permanent fix.
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
