Listen to this Post
The vulnerability exploits the non-strict parsing mode in pypdf when processing PDF files. A malicious PDF crafted without the mandatory /Root entry in the trailer dictionary, but with an artificially large /Size value, triggers excessive computational loops. During parsing, pypdf’s reader attempts to resolve object references, and the absence of /Root combined with a high /Size leads to iterative searches through a large potential object space. This occurs because the parser, in non-strict mode, does not immediately reject the invalid structure and instead tries to recover or validate the file. The algorithm may iterate up to the /Size number, causing linear time complexity growth with the specified size. For instance, a /Size set to 1000000 forces the parser to check millions of non-existent object references, consuming CPU resources and leading to prolonged runtime. This can result in a denial-of-service condition where the application becomes unresponsive while processing the file. The issue is specific to the non-strict mode, as strict mode would raise an exception early for the missing /Root. The vulnerability is rooted in the PDF trailer parsing logic where boundary checks and validation are insufficient for this edge case.
Platform: pypdf
Version: <6.6.0
Vulnerability: Denial of Service
Severity: Low
date: 2026-01-09
Prediction: Patched 2026-01-09
What Undercode Say:
Analytics
pip show pypdf python -c "import pypdf; print(pypdf.<strong>version</strong>)"
import pypdf
reader = pypdf.PdfReader("malicious.pdf", strict=False)
How Exploit
Craft PDF missing /Root with large /Size.
Protection from this CVE
Update to pypdf>=6.6.0.
Impact
Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
