CVE-2026-41168: 
Python vulnerability analysis and mitigation

CVE-2026-41168 is a denial-of-service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by excessive iteration when parsing maliciously crafted PDF files. An attacker can craft a PDF with cross-reference streams containing artificially large /Size values or object streams with artificially large /N values, causing the library to perform unbounded iteration and resulting in extremely long processing times. All versions of pypdf prior to 6.10.1 are affected. The vulnerability was published on April 22, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-834 (Excessive Iteration): pypdf did not enforce upper bounds on the /Size field in PDF 1.5+ cross-reference (XRef) streams or the /N field in object streams before iterating over them. An attacker-supplied large integer in either field causes the parser to attempt a proportionally large number of loop iterations, consuming CPU resources without limit. The fix introduced a dynamic cap based on the actual stream byte size — for object streams, the maximum /N is derived as stream_data.nbytes // 3 (since the smallest valid header entry is 3 bytes), and for XRef streams, total entry counts are clamped to len(stream_data) // min_entry_bytes + 1. No authentication or user interaction is required; the attack vector is network-accessible wherever an application accepts and parses user-supplied PDFs (GitHub Advisory, Patch PR, Patch Commit).

Successful exploitation causes a denial-of-service condition in any application that uses pypdf to process untrusted PDF files, as the parser becomes occupied with excessive iteration and is unable to serve other requests. There is no impact on confidentiality or integrity — only availability is affected. Applications such as document management systems, web services accepting PDF uploads, or automated PDF processing pipelines are at risk of resource exhaustion and degraded or complete loss of service (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The attack requires no privileges, no user interaction, and is reachable over the network, making it straightforward to attempt against exposed services, but the limited impact (availability only) reduces attacker incentive.

1. Identify a target: Locate a web service or application that accepts PDF file uploads and processes them using pypdf (versions < 6.10.1), such as a document conversion API or PDF viewer backend.
2. Craft a malicious PDF: Create a minimal PDF file with a cross-reference stream (/Type /XRef) that specifies an artificially large /Size value (e.g., /Size 50000000) with a near-empty or empty stream body, or an object stream (/Type /ObjStm) with a large /N value (e.g., /N 5000000) and minimal stream content.
3. Submit the PDF: Upload or send the crafted PDF to the target application via its normal file intake mechanism (e.g., HTTP multipart upload).
4. Trigger excessive iteration: When pypdf parses the file, it reads the inflated /Size or /N value and begins iterating up to that count without bounds checking, consuming CPU for an extended period.
5. Achieve denial of service: The application's PDF processing thread or process becomes unresponsive or severely degraded, potentially blocking legitimate requests and exhausting server resources (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP requests uploading small PDF files to document processing endpoints; unusually high request rates to PDF intake APIs from a single source.
• Process: pypdf worker processes or threads consuming near-100% CPU for extended durations (minutes or longer) while processing a single file; application response times spiking or timing out during PDF parsing operations.
• Logs: Application logs showing PDF parsing operations that never complete or exceed expected timeouts; log entries such as "Clamping XRef count from <large_number> to <small_number> to fit stream size." or "Value /N <large_number> for object <id> exceeds maximum allowed value <small_number>. Limiting to <small_number>." (present in patched versions with warnings enabled).
• File System: Presence of small PDF files (a few hundred bytes) with unusually large /Size or /N values in upload directories or temporary processing folders.

Upgrade pypdf to version 6.10.1 or later, which limits the allowed size of XRef and object streams based on actual stream content (pypdf Release). If an immediate upgrade is not possible, manually apply the changes from PR #3733 to the local pypdf installation (Patch PR). As additional defensive measures, implement processing timeouts on PDF parsing operations, apply rate limiting to PDF upload endpoints, and consider validating or sandboxing PDF processing to limit resource consumption from malicious inputs.

The vulnerability was reported by researcher alpakalee and analyzed and patched by pypdf maintainer stefan6419846 (GitHub Advisory). The NixOS/nixpkgs security tracker opened a tracking issue (NixOS/nixpkgs#512706) shortly after disclosure, and the fix was picked up by OpenSUSE security announcements and Linux distribution security channels. No significant broader media coverage or notable social media discussion has been observed.