CVE-2023-46250

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

• CWE-835

• https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2dPatch
• https://github.com/py-pdf/pypdf/pull/2264Issue Tracking, Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63fVendor Advisory
• https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2dPatch
• https://github.com/py-pdf/pypdf/pull/2264Issue Tracking, Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63fVendor Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46245Kimai is a web-based multi-user time-tracking application. V…7.2
• CVE-2023-46246Vim is an improved version of the good old UNIX editor Vi. H…5.5
• CVE-2023-46247Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-46249authentik is an open-source Identity Provider. Prior to vers…9.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46252Squidex is an open source headless CMS and content managemen…6.1
• CVE-2023-46253Squidex is an open source headless CMS and content managemen…7.2
• CVE-2023-46254capsule-proxy is a reverse proxy for Capsule kubernetes mult…4.3
• CVE-2023-46255SpiceDB is an open source, Google Zanzibar-inspired database…6.5
• CVE-2023-46256PX4-Autopilot provides PX4 flight control solution for drone…9.8