What is GHSA-g9xf-7f8q-9mcj?

GHSA-g9xf-7f8q-9mcj is a security advisory published by GitHub Security Advisories with Medium severity. pypdf: Possible infinite loop when processing threads/articles in writer

Which CVE IDs does GHSA-g9xf-7f8q-9mcj cover?

GHSA-g9xf-7f8q-9mcj covers the following CVE IDs: CVE-2026-54651. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-g9xf-7f8q-9mcj?

GHSA-g9xf-7f8q-9mcj affects 1 product, including: pip/pypdf:\u003c 6.13.1.

GHSA-g9xf-7f8q-9mcjMedium

pypdf: Possible infinite loop when processing threads/articles in writer

Vendor

GitHub Security Advisories

Published

July 9, 2026

Last Modified

July 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-54651 →

📋 Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer.

Patches

This has been fixed in pypdf==6.13.1.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #3839.

🎯 Affected products1

pip/pypdf:< 6.13.1

🔗 References (5)

https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj
https://nvd.nist.gov/vuln/detail/CVE-2026-54651
https://github.com/py-pdf/pypdf/pull/3839
https://github.com/py-pdf/pypdf/releases/tag/6.13.1
https://github.com/advisories/GHSA-g9xf-7f8q-9mcj