CVE-2023-36464
mediumpypdf is an open source, pure-python PDF library.
Vendor / product: Py-pdf — pypdf
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2023-06-27 22:15
Modified: 2026-11-02 16:06
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
py-pdf / pypdf <3.9.0
pypdf2_project / pypdf2 ≥2.2.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/1828
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/969
Patch / mitigation: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/1828
Patch / mitigation: https://github.com/py-pdf/pypdf/pull/969
Patch / mitigation: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8
References
- https://github.com/py-pdf/pypdf/pull/1828 security-advisories@github.com
- https://github.com/py-pdf/pypdf/pull/969 security-advisories@github.com
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 security-advisories@github.com
- https://github.com/py-pdf/pypdf/pull/1828 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/py-pdf/pypdf/pull/969 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗