Log in Start free

Vulnerability · Published Oct 31, 2023 · Assigned by GitHub_M

CVE-2023-46250pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

Medium 5.1

In plain English

A medium-severity infinite loop in pypdf from py-pdf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.3%top 82.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpypdf3.17.0PYSEC-2026-1834
PyPIpypdf3.17.0GHSA-wjcc-cq79-p63f
Ubuntu:24.04:LTSpypdfno fix listedUBUNTU-CVE-2023-46250
Ubuntu:25.10pypdfno fix listedUBUNTU-CVE-2023-46250
Ubuntu:26.04:LTSpypdfno fix listedUBUNTU-CVE-2023-46250
Ubuntu:26.10pypdfno fix listedUBUNTU-CVE-2023-46250
Ubuntu:22.04:LTSpypdf2no fix listedUBUNTU-CVE-2023-46250
Ubuntu:24.04:LTSpypdf2no fix listedUBUNTU-CVE-2023-46250

Affected products (as reported)

VendorProductVersions
py-pdf pypdf >= 3.7.0, < 3.17.0

Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References