CVE-2026-33699Medium· 6.5▾ SunlitA flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resou…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
Last analysed / modified upstream
— → 6.5
0.5% → 0.6%
A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resources, making the application unresponsive.
pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode — rated Moderate by Red Hat. Released 2026-03-26, updated 2026-10-15.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 2.25.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:42644 For Red Hat OpenShift AI 3.3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:37275
Workarounds / mitigations:
Affected packages:
pypdf < 6.9.2Patched in:
pypdf 6.9.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59935Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image (CVE-2026-59935)
CVE-2026-42561High· 7.5python-multipart: python-multipart: Denial of Service via excessive multipart part headers (CVE-2026-42561)
CVE-2026-59936Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF inline image (CVE-2026-59936)
CVE-2026-59938Medium· 5.3pypdf: pypdf: Possible large memory usage for wrong image dimensions (CVE-2026-59938)
CVE-2026-59937Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams (CVE-2026-59937)
CVE-2026-6855High· 7.1instructlab: InstructLab: Path traversal allows arbitrary directory creation and file write (CVE-2026-6855)