p PatchFirst

CVE-2023-36464

CVE-2023-36464 · Infinite Loop when a comment isn't followed by a character in pypdf

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.

CVSS 6.2 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pypdf

    Versions
    • pypdf: < 3.90: Affected
    • PyPDF2: >= 2.2.0: Affected

    No fix published

  • pypdf Debian:12

    Versions
    • 3.4.1-1
    Affected ranges
    • ECOSYSTEM: < 3.4.1-1+deb12u1

    Update to 3.4.1-1+deb12u1

  • pypdf Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.17.4-1

    Update to 3.17.4-1

  • pypdf Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.17.4-1

    Update to 3.17.4-1

  • pypdf2 Debian:12

    Versions
    • 2.12.1-3
    Affected ranges
    • ECOSYSTEM: < 2.12.1-3+deb12u1

    Update to 2.12.1-3+deb12u1

  • pypdf PyPI

    Versions
    • 3.1.0
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.4.0
    • 3.4.1
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.7.0
    • 3.7.1
    • 3.8.0
    • 3.8.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.1.0, < 3.9.0

    Update to 3.9.0

  • pypdf2 PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.10.4
    • 2.10.5
    • 2.10.6
    • 2.10.7
    • 2.10.8
    • 2.10.9
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.12.0
    • 2.12.1
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, ≤ 3.0.1

    No fix published

  • pypdf2 PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.10.4
    • 2.10.5
    • 2.10.6
    • 2.10.7
    • 2.10.8
    • 2.10.9
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.12.0
    • 2.12.1
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 3.9.0

    Update to 3.9.0

  • pypdf Ubuntu:24.04:LTS

    Versions
    • 3.4.1-1
    • 3.17.4-1
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:25.10

    Versions
    • 4.3.1-1
    • 5.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.10

    Versions
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.04:LTS

    Versions
    • 5.4.0-1
    • 6.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →