1.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27628

CVE-2026-27628: pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27628

CVE-2026-27628:

1.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.2	6.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit f0a462d36971cf077d74492a348d0d06fd60ea4d clearly indicates that the vulnerability is located in the _read_xref_tables_and_trailers method of the PdfReader class in pypdf/_reader.py. The patch directly addresses an infinite loop condition by adding a check for circular references within the while loop that iterates through the PDF's cross-reference tables. The added code keeps track of visited startxref offsets and breaks the loop if a previously visited offset is encountered, thus preventing the infinite loop. The test file tests/test_reader.py further confirms this by adding a specific test case, test_circular_xref_prev_reference, which constructs a PDF with a circular /Prev reference to ensure the fix works as expected. Therefore, the PdfReader._read_xref_tables_and_trailers function is the precise location of the vulnerability.

Vulnerable functions

PdfReader._read_xref_tables_and_trailers

pypdf/_reader.py

The vulnerability lies in the `_read_xref_tables_and_trailers` function within the `PdfReader` class. This function is responsible for parsing the cross-reference (xref) tables in a PDF file. A specially crafted PDF can contain a circular reference in the `/Prev` key of its xref table, which points to a previous xref table. Without a mechanism to detect this circular dependency, the `while startxref is not None:` loop would continuously process the same sequence of xref tables, resulting in an infinite loop and a denial-of-service condition. The patch mitigates this by introducing a `visited_xref_offsets` set to track the file offsets of already processed xref tables. If an offset is encountered again, the loop is terminated.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.