High · published October 23, 2025
⚠️ A sneaky infinite loop lurks in pypdf! This crafty vulnerability can trap your PDF parsing in an endless cycle before you even know what hit you. 🔄 Imagine trying to read a book but every time you turn the page, you just end up right back at the beginning — frustrating, right? That's what this bug does to any application trying to parse a PDF with an inline image using the DCTDecode filter. An attacker could craft a malicious PDF to exploit this flaw, causing your application to hang indefinitely while it tries to parse the endless content stream. This could lead to service disruptions and affect user experience while your system is stuck in this loop!
Imagine trying to read a book but every time you turn the page, you just end up right back at the beginning — frustrating, right? That's what this bug does to any application trying to parse a PDF with an inline image using the DCTDecode filter. This vulnerability in pypdf allows an attacker to trigger an infinite loop during PDF parsing when the content stream contains an inline image with a DCTDecode filter, causing the application to become unresponsive.
An attacker could craft a malicious PDF to exploit this flaw, causing your application to hang indefinitely while it tries to parse the endless content stream. This could lead to service disruptions and affect user experience while your system is stuck in this loop! To protect against this issue, update to pypdf version 6.1.3 or later. If you're using an older version, ensure you review your PDF handling processes and implement necessary checks to avoid potential hangups. You've got this! With this update, you'll keep your PDF parsing smooth and your applications running smoothly. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pypdf_project/pypdf | < 6.1.3 | 6.1.3 |