CVE-2023-36464— Infinite Loop when a comment isn't followed by a character in pypdf
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-36464
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Infinite Loop when a comment isn't followed by a character in pypdf
Source: CVE Program / CVE List V5
Vulnerability Description
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
PyPDF2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PyPDF2是一个免费的开源纯 python PDF 库。能够拆分、 合并、 裁剪和转换 PDF 文件的页面。 PyPDF2 2.2.0 到3.8.1版本存在安全漏洞，该漏洞源于攻击者可能会制作一个 PDF，如果执行__parse_content_stream，则会导致无限循环。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-36464
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-36464
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-36464 (2)
- https://github.com/py-pdf/pypdf/pull/969x_refsource_MISC
- https://github.com/py-pdf/pypdf/pull/1828x_refsource_MISC
Vendor Advisories for CVE-2023-36464 (1)
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: pypdf
- CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre - CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C - CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline imag - CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline imag - CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-r
Same vendor: py-pdf
- CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre - CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C - CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline imag - CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline imag - CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-r
Same weakness: CWE-835
- CVE-2026-45271
picotls has infinite recursion in the minicrypto ASN.1 decod - CVE-2026-61556
LiquidJS: An infinite loop vulnerability in `strip_html` fil - CVE-2026-12629
PL011 UART error interrupts never cleared, enabling an exter - CVE-2026-68762
JetBrains Ktor 资源管理错误漏洞 - CVE-2026-13002
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap
V. Comments for CVE-2023-36464
No comments yet