pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-10-31T15:23:32.852Z

Updated: 2024-09-05T18:54:52.306Z

Reserved: 2023-10-19T20:34:00.948Z

Link: CVE-2023-46250

cve-icon Vulnrichment

Updated: 2024-08-02T20:37:40.140Z

cve-icon NVD

Status : Modified

Published: 2023-10-31T16:15:09.930

Modified: 2024-11-21T08:28:10.137

Link: CVE-2023-46250

cve-icon Redhat

No data.