---
id: CVE-2026-33699
title: >-
  pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode
  (CVE-2026-33699)
summary: >-
  A flaw was found in pypdf. An attacker can craft a malicious PDF file that,
  when processed by pypdf in non-strict mode, triggers an infinite loop. This
  vulnerability can lead to a Denial of Service (DoS) by consuming excessive
  system resou…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-606
vendor: Red Hat
product: Red Hat Enterprise Linux AI (RHEL AI) 3
affected:
  - lightspeed_core
  - openshift_lightspeed
  - ansible_automation_platform 2
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai 2.25
  - openshift_ai 3.3
patched:
  - openshift_ai 2.25
  - openshift_ai 3.3
published: '2026-03-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:35:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-33699'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2452062'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33699'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33699'
  - url: 'https://github.com/py-pdf/pypdf/pull/3693'
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.9.2'
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42644'
  - url: 'https://access.redhat.com/errata/RHSA-2026:37275'
  - url: 'https://github.com/py-pdf/pypdf'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00472
epssPercentile: 0.40959
aliases:
  - GHSA-87mj-5ggw-8qc3
  - PYSEC-2026-3012
ecosystem: pip
ingestedAt: '2026-07-13T18:57:54.870Z'
---

## Overview

A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resources, making the application unresponsive.

## Vendor advisories

- **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644)
- **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275)
- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33699.json)

**pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode** — rated Moderate by Red Hat. Released 2026-03-26, updated 2026-10-15.

Affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI) 3

Fixed:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3

No fix planned:

- Red Hat Ansible Automation Platform 2
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI) 3

Not affected:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- OpenShift Lightspeed

## Remediation

For Red Hat OpenShift AI 2.25.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:42644
For Red Hat OpenShift AI 3.3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:37275

Workarounds / mitigations:

- To mitigate this issue, avoid processing untrusted PDF files with pypdf, particularly when operating in non-strict mode. Ensuring that applications using pypdf are configured to operate in strict mode, if supported, can prevent exploitation.

## Package advisory (CVE-2026-33699)

Affected packages:

- `pypdf < 6.9.2`

Patched in:

- `pypdf 6.9.2`

Source: https://osv.dev/vulnerability/GHSA-87mj-5ggw-8qc3