Medium5.9Red Hat Linux

Medium [CVE-2026-54651] Denial of Service via crafted PDF

This medium-severity Red Hat Linux advisory covers CVE-2026-54651 affecting Exploit Intelligence, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2.

CVE-2026-54651 Published Jun 22, 2026Updated by vendor Jun 22, 2026

CVE-2026-54651

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop.

This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

A flaw was found in pypdf. This vulnerability can result in a Denial of Service (DoS) condition, making the affected system unresponsive.

Red Hat rates this issue as Moderate severity (CVSS 5.9) because exploitation requires a specially crafted PDF containing thread/article objects to be processed by pypdf's merge functionality. Weakness: CWE-835.

Affected Red Hat products: Exploit Intelligence; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3. Red Hat does not currently list a fixing RHSA for this CVE.

Affected versions

< 6.13.1

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Fixed versions

6.13.1

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

If PDF processing is required, implement processing timeouts and resource constraints (CPU/memory limits) to contain the impact of infinite loops. Running pypdf workloads in containerized processes with enforced resource limits provides defense-in-depth. Upgrading to pypdf >= 6.13.1 resolves this issue.

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.