CVE-2017-18186

An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.

• CWE-835

• https://github.com/qpdf/qpdf/commit/85f05cc57ffa0a863d9d9b23e73acea9410b2937Third Party Advisory
• https://github.com/qpdf/qpdf/issues/149Third Party Advisory
• https://usn.ubuntu.com/3638-1/
• https://github.com/qpdf/qpdf/commit/85f05cc57ffa0a863d9d9b23e73acea9410b2937Third Party Advisory
• https://github.com/qpdf/qpdf/issues/149Third Party Advisory
• https://usn.ubuntu.com/3638-1/

Published

Feb 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18178Authenticate/SWT in Progress Sitefinity 9.1 has an open redi…
• CVE-2017-18179Progress Sitefinity 9.1 uses wrap_access_token as a non-expi…
• CVE-2017-1818Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18183An issue was discovered in QPDF before 7.0.0. There is an in…
• CVE-2017-18184An issue was discovered in QPDF before 7.0.0. There is a sta…
• CVE-2017-18185An issue was discovered in QPDF before 7.0.0. There is a lar…
• CVE-2017-18187In ARM mbed TLS before 2.7.0, there is a bounds-check bypass…
• CVE-2017-18188OpenRC opentmpfiles through 0.1.3, when the fs.protected_har…
• CVE-2017-18189In the startread function in xa.c in Sound eXchange (SoX) th…
• CVE-2017-1819Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18190A localhost.localdomain whitelist entry in valid_host() in s…
• CVE-2017-18191An issue was discovered in OpenStack Nova 15.x through 15.1.…