5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24688

CVE-2026-24688: pypdf has possible Infinite Loop when processing outlines/bookmarks

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24688

CVE-2026-24688:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.6.2	6.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1 clearly indicates that the vulnerability lies within the _get_outline function in pypdf/_doc_common.py. The patch introduces a visited set to track the nodes that have already been processed during the outline traversal. Before processing a node, the modified code checks if the node's ID is in the visited set. If it is, a cycle is detected, a warning is logged, and the loop is terminated, thus preventing the infinite loop. The removed code lacks this check, making it vulnerable. The public outline property of the PdfReader class calls this private _get_outline method, which is how the vulnerability would be triggered in a real-world scenario.

Vulnerable functions

_get_outline

pypdf/_doc_common.py

The `_get_outline` function is responsible for parsing the outline (bookmark) structure of a PDF file. The vulnerability exists because the function recursively traverses the outline nodes without keeping track of visited nodes. An attacker can create a malicious PDF with a circular reference in its outline structure. When `_get_outline` processes this file, it enters an infinite recursion, leading to a denial-of-service condition.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.