pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.
Weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pypdf | Pypdf_project | * | 6.7.2 (excluding) |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-llama-stack-core-rhel9:1775144403 | * |
| Red Hat Quay 3.1 | RedHat | quay/quay-rhel8:1773971077 | * |
| Red Hat Quay 3.12 | RedHat | quay/quay-rhel8:1773771962 | * |
| Red Hat Quay 3.15 | RedHat | quay/quay-rhel8:1775169219 | * |
| Red Hat Quay 3.16 | RedHat | quay/quay-rhel9:1775069491 | * |
| Red Hat Quay 3.16 | RedHat | quay/quay-rhel9:1775169226 | * |
| Red Hat Quay 3.9 | RedHat | quay/quay-rhel8:1773936323 | * |
| Pypdf | Ubuntu | questing | * |
| Pypdf2 | Ubuntu | esm-apps/xenial | * |