CVE-2026-24688Medium· 5.3▾ TwilightPoC availableA reachable infinite loop has been discovered in pypdf. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
2 GitHub repos
0.4% → 0.5%
Last analysed / modified upstream
— → 5.3
A reachable infinite loop has been discovered in pypdf. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks.
pypdf: pypdf Infinite Loop when processing outlines/bookmarks — rated Moderate by Red Hat. Released 2026-01-27, updated 2026-10-15.
Affected:
No fix planned:
Fix deferred
Workarounds / mitigations:
Affected packages:
pypdf < 6.6.2Patched in:
pypdf 6.6.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22690Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with missing /Root object (CVE-2026-22690)
CVE-2026-22691Medium· 6.5pypdf: pypdf: Denial of Service via malformed PDF startxref entries (CVE-2026-22691)
CVE-2026-33154High· 7.5dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-41481Medium· 6.5langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)