{"id":"CVE-2026-33699","title":"pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode (CVE-2026-33699)","summary":"A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resou…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-606","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai 2.25","openshift_ai 3.3"],"patched":["openshift_ai 2.25","openshift_ai 3.3"],"published":"2026-03-26","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:35:35+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33699"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452062"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33699"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33699"},{"url":"https://github.com/py-pdf/pypdf/pull/3693"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.9.2"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00472,"epssPercentile":0.40666,"aliases":["GHSA-87mj-5ggw-8qc3","PYSEC-2026-3012"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:54.870Z","slug":"CVE-2026-33699","body":"## Overview\n\nA flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resources, making the application unresponsive.\n\n## Vendor advisories\n\n- **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644)\n- **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275)\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json)\n\n**pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode** — rated Moderate by Red Hat. Released 2026-03-26, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nFixed:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- OpenShift Lightspeed\n\n## Remediation\n\nFor Red Hat OpenShift AI 2.25.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:42644\nFor Red Hat OpenShift AI 3.3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:37275\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, avoid processing untrusted PDF files with pypdf, particularly when operating in non-strict mode. Ensuring that applications using pypdf are configured to operate in strict mode, if supported, can prevent exploitation.\n\n## Package advisory (CVE-2026-33699)\n\nAffected packages:\n\n- `pypdf < 6.9.2`\n\nPatched in:\n\n- `pypdf 6.9.2`\n\nSource: https://osv.dev/vulnerability/GHSA-87mj-5ggw-8qc3","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222185,"id":"CVE-2026-33699","ts":1792065055600,"field":"cvss","old":null,"new":"6.5"}]}