AIKIDO-2026-10938
pypdf is vulnerable to Excessive Iteration
53
Medium Risk
This Affects:
pypdfTL;DR
When pypdf parses PDF 1.5 cross-reference streams, _sanitize_pdf15_xref_stream_index_pairs treated zero-only /W width arrays as a minimum entry size of one byte. A crafted PDF can combine /W [0 0 0] with a very large /Size so opening the file drives excessive iteration over xref entries. Before the fix, processing such a PDF could hang or run for a long time in non-strict mode. The fix rejects zero-only /W values and stops xref parsing instead of iterating over bogus entry counts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pypdf is vulnerable to Excessive Iteration in versions 0.0.1 - 6.11.0.
How to fix this
Upgrade the pypdf library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant