CVE-2017-11624

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."

• CWE-835

• http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf.htmlExploit, Third Party Advisory
• https://github.com/qpdf/qpdf/issues/117Exploit, Third Party Advisory
• https://usn.ubuntu.com/3638-1/
• http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf.htmlExploit, Third Party Advisory
• https://github.com/qpdf/qpdf/issues/117Exploit, Third Party Advisory
• https://usn.ubuntu.com/3638-1/

Published

Jul 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11612In Joomla! before 3.7.4, inadequate filtering of potentially…
• CVE-2017-11613In LibTIFF 4.0.8, there is a denial of service vulnerability…
• CVE-2017-11614MEDHOST Connex contains hard-coded credentials that are used…
• CVE-2017-11615A sandbox escape in the Lua interface in Wube Factorio befor…
• CVE-2017-11617Cross-site scripting (XSS) vulnerability in atmail prior to …
• CVE-2017-1162IBM QRadar 7.2 and 7.3 discloses sensitive information to un…
• CVE-2017-11625A stack-consumption vulnerability was found in libqpdf in QP…
• CVE-2017-11626A stack-consumption vulnerability was found in libqpdf in QP…
• CVE-2017-11627A stack-consumption vulnerability was found in libqpdf in QP…
• CVE-2017-11628In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.…
• CVE-2017-11629dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS)…
• CVE-2017-11630dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.…