Most recent entries from all

bdu:2026-07338

BREW-pdfalyzer-CVE-2026-33699 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

Affected: Homebrew: pdfalyzer

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

EUVD-2026-277885

fkie_cve-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.

GHSA-87mj-5ggw-8qc3 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

openSUSE-SU-2026:10464-1 — python311-pypdf-6.9.2-1.1 on GA media

python311-pypdf-6.9.2-1.1 on GA media

PYSEC-2026-3012 — pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode.

### Patches

This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

RHSA-2026:37275 — Red Hat Security Advisory: RHOAI 3.3.5 - Red Hat OpenShift AI

golang: net/url: Memory exhaustion in query parameter parsing in net/url aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb keras: Keras: Arbitrary Code Execution Vulnerability Bypassing Safe Mode mlflow: mlflow: Arbitrary file read via bypassed source path validation python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting multipart: denial of service via maliciously crafted HTTP or multipart segment headers python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion tornado-python: Tornado: Denial of Service via large multipart bodies pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) simpleeval: SimpleEval: Arbitrary code execution via sandbox escape due to improper object handling google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nltk: NLTK: Denial of Service via unauthenticated remote shutdown nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files react-router: React Route…

UBUNTU-CVE-2026-33699

Affected: Ubuntu:Pro:16.04:LTS: pypdf2, Ubuntu:Pro:18.04:LTS: pypdf2, Ubuntu:20.04:LTS: pypdf2, Ubuntu:22.04:LTS: pypdf2, Ubuntu:24.04:LTS: pypdf, Ubuntu:24.04:LTS: pypdf2, Ubuntu:25.10: pypdf, Ubuntu:26.04:LTS: pypdf