https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:38:17.658671+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07338 bdu:2026-07338 2026-10-02T22:38:17.939098+00:00 bdu:2026-07338 https://cve.radiocsirt.org/vuln/brew-pdfalyzer-cve-2026-33699 BREW-pdfalyzer-CVE-2026-33699 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream 2026-10-02T22:38:17.939155+00:00

Affected: Homebrew: pdfalyzer

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

 https://cve.radiocsirt.org/vuln/euvd-2026-277885 EUVD-2026-277885 2026-10-02T22:38:17.939199+00:00 EUVD-2026-277885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33699 fkie_cve-2026-33699 2026-10-02T22:38:17.939231+00:00

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.

 https://cve.radiocsirt.org/vuln/ghsa-87mj-5ggw-8qc3 GHSA-87mj-5ggw-8qc3 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream 2026-10-02T22:38:17.939258+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10464-1 openSUSE-SU-2026:10464-1 — python311-pypdf-6.9.2-1.1 on GA media 2026-10-02T22:38:17.939284+00:00

python311-pypdf-6.9.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-3012 PYSEC-2026-3012 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream 2026-10-02T22:38:17.939303+00:00

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

 https://cve.radiocsirt.org/vuln/rhsa-2026:37275 RHSA-2026:37275 — Red Hat Security Advisory: RHOAI 3.3.5 - Red Hat OpenShift AI 2026-10-02T22:38:17.939327+00:00

golang: net/url: Memory exhaustion in query parameter parsing in net/url aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb keras: Keras: Arbitrary Code Execution Vulnerability Bypassing Safe Mode mlflow: mlflow: Arbitrary file read via bypassed source path validation python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting multipart: denial of service via maliciously crafted HTTP or multipart segment headers python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion tornado-python: Tornado: Denial of Service via large multipart bodies pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) simpleeval: SimpleEval: Arbitrary code execution via sandbox escape due to improper object handling google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nltk: NLTK: Denial of Service via unauthenticated remote shutdown nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files react-router: React Route…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33699 UBUNTU-CVE-2026-33699 2026-10-02T22:38:17.939401+00:00

Affected: Ubuntu:Pro:16.04:LTS: pypdf2, Ubuntu:Pro:18.04:LTS: pypdf2, Ubuntu:20.04:LTS: pypdf2, Ubuntu:22.04:LTS: pypdf2, Ubuntu:24.04:LTS: pypdf, Ubuntu:24.04:LTS: pypdf2, Ubuntu:25.10: pypdf, Ubuntu:26.04:LTS: pypdf

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.