Launch Week Day 1: Announcing Security Design Review
UNKNOWN PyPI

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

GHSA-87mj-5ggw-8qc3 · CVE-2026-33699

Published · Modified

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

Patches

This has been fixed in pypdf==6.9.2.

Workarounds

If users cannot upgrade yet, consider applying the changes from PR #3693.

Ready to move

Start Securing

Free, no credit card | First findings in minutes