Read the docs
TI-2023-24877 Aliases CVE-2023-46250GHSA-wjcc-cq79-p63f

pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

Priority LOW 24CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed pypdf (py-pdf): 3.17.0pypdf (PyPI): 3.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
py-pdfpypdf3.7.0 to before 3.17.03.17.0Patch availableCNA
—pypdf (PyPI)3.7.0 to before 3.17.03.17.0Patch availableGHSA-wjcc-cq79-p63f
  • pypdf Vendorpy-pdf Affected 3.7.0 to before 3.17.0 Fixed in 3.17.0 Patch available CNA
  • pypdf (PyPI) Vendor— Affected 3.7.0 to before 3.17.0 Fixed in 3.17.0 Patch available GHSA-wjcc-cq79-p63f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*3.7.0 to before 3.17.0Vulnerablepy-pdf
  • cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:* Versions 3.7.0 to before 3.17.0 Vulnerable ·py-pdf

Remediation

  • Fix · CNA pypdf (py-pdf) Fixed in 3.17.0
  • Fix · GHSA-wjcc-cq79-p63f pypdf (PyPI) Fixed in 3.17.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46250
  2. 2026-10-03 Alias added: GHSA-wjcc-cq79-p63f

References

Patch 2

Advisory 2

Other 1

  • TI-2023-18601 Infinite Loop when reading malformed objects in pypdf CVSS 3.1MEDIUM 6.5
  • TI-2023-18305 Infinite Loop when a comment isn't followed by a character in pypdf CVSS 3.1MEDIUM 6.2
  • TI-2026-42743 pypdf: Possible infinite loop for not terminated inline images CVSS 4.0HIGH 8.7
  • TI-2026-42742 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) CVSS 4.0HIGH 8.7
  • TI-2026-65557 pypdf: Possible large memory usage when retrieving alphabetical page labels CVSS 4.0HIGH 8.7
  • TI-2026-65556 pypdf: Possible long runtimes with large amount of embedded files CVSS 4.0HIGH 8.7
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences