VYPR
Moderate severityNVD Advisory· Published Feb 20, 2026· Updated Feb 24, 2026

pypdf has a possible infinite loop when processing TreeObject

CVE-2026-27024

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pypdfPyPI
< 6.7.16.7.1

Affected products

1

Patches

1
bd2f6d052fe5

SEC: Detect cyclic references when accessing TreeObject.children (#3645)

https://github.com/py-pdf/pypdfStefanFeb 17, 2026via ghsa
2 files changed · +26 3
  • pypdf/generic/_data_structures.py+10 1 modified
    @@ -693,10 +693,19 @@ def children(self) -> Iterable[Any]:
                 return
     
             child_ref = self[NameObject("/First")]
    +        last = self[NameObject("/Last")]
             child = child_ref.get_object()
    +        visited: set[int] = set()
             while True:
    +            child_id = id(child)
    +            if child_id in visited:
    +                logger_warning(f"Detected cycle in outline structure for {child}", __name__)
    +                return
    +            visited.add(child_id)
    +
                 yield child
    -            if child == self[NameObject("/Last")]:
    +
    +            if child == last:
                     return
                 child_ref = child.get(NameObject("/Next"))  # type: ignore
                 if is_null_or_none(child_ref):
    
  • tests/generic/test_data_structures.py+16 2 modified
    @@ -1,6 +1,6 @@
     """Test the pypdf.generic._data_structures module."""
    -from pypdf import PdfReader
    -from pypdf.generic import DictionaryObject
    +from pypdf import PdfReader, PdfWriter
    +from pypdf.generic import DictionaryObject, NameObject, TreeObject
     from tests import RESOURCE_ROOT
     
     
    @@ -23,3 +23,17 @@ def test_dictionary_object__get_next_object_position():
         assert DictionaryObject._get_next_object_position(
             position_before=10, position_end=999999, generations=list(reader.xref), pdf=reader
         ) == 15
    +
    +
    +def test_tree_object__cyclic_reference(caplog):
    +    writer = PdfWriter()
    +    child1 = writer._add_object(DictionaryObject())
    +    child2 = writer._add_object(DictionaryObject({NameObject("/Next"): child1}))
    +    child3 = writer._add_object(DictionaryObject({NameObject("/Next"): child2}))
    +    child1.get_object()[NameObject("/Next")] = child3
    +    tree = TreeObject()
    +    tree[NameObject("/First")] = child2
    +    tree[NameObject("/Last")] = writer._add_object(DictionaryObject())
    +
    +    assert list(tree.children()) == [child2.get_object(), child1.get_object(), child3.get_object()]
    +    assert "Detected cycle in outline structure for " in caplog.text
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.