Description
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| py-pdf | PyPDF2 | < 1.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | pypdf2 | 1.27.9-1 | — |
| Debian 10 | pypdf2 | 1.26.0-2+deb10u1 | DLA-3451-1 |
| Debian 9 | pypdf2 | 1.26.0-2+deb9u1 | DLA-3039-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | pypdf2 | 1.26.0-4ubuntu0.22.04.1 | USN-6176-1 |
| Ubuntu 20.04 LTS | pypdf2 | 1.26.0-3ubuntu1.20.04.1 | USN-6176-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | pypdf2 | 1.26.0-2ubuntu0.1~esm1 | USN-6176-1 |
| Ubuntu Pro 16.04 LTS | pypdf2 | 1.25.1-1ubuntu0.1~esm1 | USN-6176-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | python-PyPDF2 | 1.26.0-bp156.4.3.1 | openSUSE-SU-2024:0366-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | python-PyPDF2 | 1.26.0-bp156.4.3.1 | openSUSE-SU-2024:0366-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pypdf2 | < 1.27.5 | 1.27.5 | GHSA-xcjx-m2pj-8g79 |
Advisories 4
- USN-6176-1 pypdf2 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3451-1 pypdf2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3039-1 pypdf2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:0366-1 Security update for python-PyPDF2 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79
- https://github.com/py-pdf/PyPDF2/issues/329
- https://github.com/py-pdf/PyPDF2/pull/740
- https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5
- [debian-lts-announce] 20220603 [SECURITY] [DLA 3039-1] pypdf2 security update mailing-list
- [debian-lts-announce] 20230609 [SECURITY] [DLA 3451-1] pypdf2 security update mailing-list