mediumVulnerability
CVE-2026-54651
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. ### Patches This has been fixed in [pypdf==6.13.1](https://github.com/py-pdf/pypdf/releases/tag/6.13.1). ### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#3839](https://github.com/py-pdf/pypdf/pull/3839).
Properties
- ghsa_id
- GHSA-g9xf-7f8q-9mcj
- severity
- medium
- summary
- pypdf: Possible infinite loop when processing threads/articles in writer
- epss_score
- 0.0011
- cve_id
- CVE-2026-54651
- is_ghsa_only
- false
- ghsa_published
- 2026-07-09T21:09:53Z
- source_url
- https://github.com/advisories/GHSA-g9xf-7f8q-9mcj
- epss_percentile
- 0.0148
- ghsa_updated
- 2026-07-09T21:09:54Z
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
AFFECTS (1)
→[Software]pip/pypdf
HAS_WEAKNESS (1)
→[Weakness]Loop with Unreachable Exit Condition ('Infinite Loop')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]pip/pypdf
Explore deeper with Ninja Signal's threat intelligence graph