{"id":"CVE-2026-24688","title":"pypdf: pypdf Infinite Loop when processing outlines/bookmarks (CVE-2026-24688)","summary":"A reachable infinite loop has been discovered in pypdf. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bo…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-835","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"patched":["pypdf 6.6.2"],"published":"2026-01-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:33:54+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24688.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24688.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-24688"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433492"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24688"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24688"},{"url":"https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1"},{"url":"https://github.com/py-pdf/pypdf/pull/3610"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.6.2"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","exploit-available","osv","pip"],"epss":0.00445,"epssPercentile":0.3851,"exploits":{"github":2,"githubRepos":["https://github.com/JoakimBulow/CVE-2026-24688","https://github.com/Fomovet/cve-2026-24688"],"checkedAt":"2026-10-27T17:03:01.223Z"},"exploitAvailable":true,"aliases":["GHSA-2q4j-m29v-hq73","PYSEC-2026-1827"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:44.592Z","slug":"CVE-2026-24688","body":"## Overview\n\nA reachable infinite loop has been discovered in pypdf. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24688.json)\n\n**pypdf: pypdf Infinite Loop when processing outlines/bookmarks** — rated Moderate by Red Hat. Released 2026-01-27, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-24688)\n\nAffected packages:\n\n- `pypdf < 6.6.2`\n\nPatched in:\n\n- `pypdf 6.6.2`\n\nSource: https://osv.dev/vulnerability/GHSA-2q4j-m29v-hq73","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":222192,"id":"CVE-2026-24688","ts":1792065060198,"field":"cvss","old":null,"new":"5.3"},{"seq":5031,"id":"CVE-2026-24688","ts":1788887229762,"field":"exploit_available","old":"false","new":"true"},{"seq":3914,"id":"CVE-2026-24688","ts":1788886360478,"field":"exploit_available","old":"true","new":"false"},{"seq":2736,"id":"CVE-2026-24688","ts":1788883026332,"field":"exploit_available","old":"false","new":"true"},{"seq":1765,"id":"CVE-2026-24688","ts":1788882430269,"field":"exploit_available","old":"true","new":"false"},{"seq":871,"id":"CVE-2026-24688","ts":1788881863268,"field":"exploit_available","old":"false","new":"true"}]}