Moderate severityNVD Advisory· Published Feb 20, 2026· Updated Feb 24, 2026
pypdf has a possible infinite loop when processing TreeObject
CVE-2026-27024
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pypdfPyPI | < 6.7.1 | 6.7.1 |
Affected products
1Patches
1bd2f6d052fe5SEC: Detect cyclic references when accessing TreeObject.children (#3645)
2 files changed · +26 −3
pypdf/generic/_data_structures.py+10 −1 modified@@ -693,10 +693,19 @@ def children(self) -> Iterable[Any]: return child_ref = self[NameObject("/First")] + last = self[NameObject("/Last")] child = child_ref.get_object() + visited: set[int] = set() while True: + child_id = id(child) + if child_id in visited: + logger_warning(f"Detected cycle in outline structure for {child}", __name__) + return + visited.add(child_id) + yield child - if child == self[NameObject("/Last")]: + + if child == last: return child_ref = child.get(NameObject("/Next")) # type: ignore if is_null_or_none(child_ref):
tests/generic/test_data_structures.py+16 −2 modified@@ -1,6 +1,6 @@ """Test the pypdf.generic._data_structures module.""" -from pypdf import PdfReader -from pypdf.generic import DictionaryObject +from pypdf import PdfReader, PdfWriter +from pypdf.generic import DictionaryObject, NameObject, TreeObject from tests import RESOURCE_ROOT @@ -23,3 +23,17 @@ def test_dictionary_object__get_next_object_position(): assert DictionaryObject._get_next_object_position( position_before=10, position_end=999999, generations=list(reader.xref), pdf=reader ) == 15 + + +def test_tree_object__cyclic_reference(caplog): + writer = PdfWriter() + child1 = writer._add_object(DictionaryObject()) + child2 = writer._add_object(DictionaryObject({NameObject("/Next"): child1})) + child3 = writer._add_object(DictionaryObject({NameObject("/Next"): child2})) + child1.get_object()[NameObject("/Next")] = child3 + tree = TreeObject() + tree[NameObject("/First")] = child2 + tree[NameObject("/Last")] = writer._add_object(DictionaryObject()) + + assert list(tree.children()) == [child2.get_object(), child1.get_object(), child3.get_object()] + assert "Detected cycle in outline structure for " in caplog.text
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-996q-pr4m-cvgqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27024ghsaADVISORY
- github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295ghsax_refsource_MISCWEB
- github.com/py-pdf/pypdf/pull/3645ghsax_refsource_MISCWEB
- github.com/py-pdf/pypdf/releases/tag/6.7.1ghsax_refsource_MISCWEB
- github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgqghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.