Read the docs
TI-2023-18601 Aliases CVE-2023-36807GHSA-hm9v-vj3r-r55m

Infinite Loop when reading malformed objects in pypdf

Priority MEDIUM 62CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed PyPDF2 (PyPI): 2.10.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
py-pdfpypdf2.10.5—No fix listedCNA
—PyPDF2 (PyPI)2.10.5 to before 2.10.62.10.6Patch availableGHSA-hm9v-vj3r-r55m
  • pypdf Vendorpy-pdf Affected 2.10.5 Fixed in — No fix listed CNA
  • PyPDF2 (PyPI) Vendor— Affected 2.10.5 to before 2.10.6 Fixed in 2.10.6 Patch available GHSA-hm9v-vj3r-r55m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:py-pdf:pypdf:2.10.5:*:*:*:*:*:*:*2.10.5Vulnerablepy-pdf
  • cpe:2.3:a:py-pdf:pypdf:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·py-pdf

Remediation

  • Fix · GHSA-hm9v-vj3r-r55m PyPDF2 (PyPI) Fixed in 2.10.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36807
  2. 2026-10-03 Alias added: GHSA-hm9v-vj3r-r55m

References

Exploit 2

Patch 1

Advisory 1

Other 2

  • TI-2023-18305 Infinite Loop when a comment isn't followed by a character in pypdf CVSS 3.1MEDIUM 6.2
  • TI-2026-42743 pypdf: Possible infinite loop for not terminated inline images CVSS 4.0HIGH 8.7
  • TI-2026-42742 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) CVSS 4.0HIGH 8.7
  • TI-2026-65557 pypdf: Possible large memory usage when retrieving alphabetical page labels CVSS 4.0HIGH 8.7
  • TI-2026-65556 pypdf: Possible long runtimes with large amount of embedded files CVSS 4.0HIGH 8.7
  • TI-2026-65555 pypdf: Possible long runtimes when generating appearance streams CVSS 4.0HIGH 8.7
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences