CVE-2023-36464
mediumpriority · track · 22EPSS 0.004 · 29 %ileEURUUSEPSS · scored 2026-10-28
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (14)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-4vvm-4w3v-6mr8pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character2023-06-30ghsa · osvUS
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF. Example Code and a PDF that causes the issue: ```python from pypdf import PdfReader # https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230627T201018Z&X-Amz-Expires=300&X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2&X-Amz-SignedHeaders=host&actor_id=1658117&key_id=0&repo_id=3119517&response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf&response-content-type=application%2Fpdf reader = PdfReader("MiFO_LFO_FEIS_NOA_Published.3.pdf") page = reader.pages[0] page.extract_text() ``` The issue was introduced with https://github.com/py-pdf/pypdf/pull/969 ### Patches The issue was fixed with https://github.com/py-pdf/pypdf/pull/1828 ### Workarounds It is recommended to upgrade to `pypdf>=3.9.0`. PyPDF2 users should migrate to pypdf. If you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`: ``` OLD: while peek not in (b"\r", b"\n"): NEW: while peek not in (b"\r", b"\n", b""): ```
- PYSEC-2026-1835pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character2026-07-07vendor · osvUS
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF. Example Code and a PDF that causes the issue: ```python from pypdf import PdfReader # https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230627T201018Z&X-Amz-Expires=300&X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2&X-Amz-SignedHeaders=host&actor_id=1658117&key_id=0&repo_id=3119517&response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf&response-content-type=application%2Fpdf reader = PdfReader("MiFO_LFO_FEIS_NOA_Published.3.pdf") page = reader.pages[0] page.extract_text() ``` The issue was introduced with https://github.com/py-pdf/pypdf/pull/969 ### Patches The issue was fixed with https://github.com/py-pdf/pypdf/pull/1828 ### Workarounds It is recommended to upgrade to `pypdf>=3.9.0`. PyPDF2 users should migrate to pypdf. If you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`: ``` OLD: while peek not in (b"\r", b"\n"): NEW: while peek not in (b"\r", b"\n", b""): ```
- PYSEC-2026-3008pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character2026-07-13vendor · osvUS
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF. Example Code and a PDF that causes the issue: ```python from pypdf import PdfReader # https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230627T201018Z&X-Amz-Expires=300&X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2&X-Amz-SignedHeaders=host&actor_id=1658117&key_id=0&repo_id=3119517&response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf&response-content-type=application%2Fpdf reader = PdfReader("MiFO_LFO_FEIS_NOA_Published.3.pdf") page = reader.pages[0] page.extract_text() ``` The issue was introduced with https://github.com/py-pdf/pypdf/pull/969 ### Patches The issue was fixed with https://github.com/py-pdf/pypdf/pull/1828 ### Workarounds It is recommended to upgrade to `pypdf>=3.9.0`. PyPDF2 users should migrate to pypdf. If you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`: ``` OLD: while peek not in (b"\r", b"\n"): NEW: while peek not in (b"\r", b"\n", b""): ```
also known as (9)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2023-36464cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-36464/cnnvd
- https://github.com/py-pdf/pypdf/pull/1828cnnvd
- https://github.com/py-pdf/pypdf/pull/969cnnvd
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8cnnvd
- https://github.com/py-pdf/pypdf/pull/1828enisa_euvd
- https://github.com/py-pdf/pypdf/pull/969enisa_euvd
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan