Medium [CVE-2026-54531] Denial of Service via crafted PDF with outlines
This medium-severity Red Hat Linux advisory covers CVE-2026-54531.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop.
This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.
A flaw was found in pypdf (before 6.13.0). A crafted PDF with outlines can trigger an infinite loop when merged into a PdfWriter, causing denial of service.
An attacker who can supply such a document for merge processing may hang the application indefinitely. Red Hat exposure mirrors other pypdf consumers: Python services that merge or rewrite PDFs using the library in Quay, observability, and hybrid platform containers.
Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-835.
Red Hat lists Exploit Intelligence; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3 as not affected.
- < 6.13.0
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Mitigation
Upgrade to a fixed release: 6.13.0. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.