PT-2026-21845 · Pypi+1 · Pypdf+1

Rampageservices · Published 2026-02-25 · Updated 2026-05-21 · CVE-2026-27628

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.7.2

Description A crafted PDF file can cause an infinite loop when read, potentially impacting systems processing these files. The issue requires file reading to be triggered.

Recommendations Update to version 6.7.2 or later. As a workaround, apply the changes from PR #3655.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-07221

CVE-2026-27628

GHSA-2RW7-X74F-JG35

OPENSUSE-SU-2026:10284-1

OPENSUSE-SU-2026:20333-1

Affected Products

Red Os

Pypdf

References · 39

• 🔥 https://github.com/py-pdf/pypdf/issues/3654 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27628.json · Exploit
• https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f · Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07221 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10284-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20333-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27628 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27628 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-27628 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rw7-x74f-jg35 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27628 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27628 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27628 · Vendor Advisory