PT-2026-4845 · Pypi+1 · Pypdf+1

Joakimbulow · Published 2026-01-01 · Updated 2026-06-04 · CVE-2026-24688

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.6.2

Description A flaw exists in the pypdf library that allows attackers to trigger an infinite loop by creating a PDF file with cyclic outline references. This requires accessing the outlines or bookmarks within the PDF.

Recommendations Upgrade to pypdf version 6.6.2 or later. If upgrading is not immediately possible, apply the changes from Pull Request #3610.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-03618

CVE-2026-24688

GHSA-2Q4J-M29V-HQ73

OPENSUSE-SU-2026:10116-1

Affected Products

Red Os

Pypdf

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24688.json · Exploit
• https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1 · Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24688 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-24688 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03618 · Security Note
• https://ubuntu.com/security/CVE-2026-24688 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24688 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2q4j-m29v-hq73 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24688 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10116-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24688 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24688 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24688 · Vendor Advisory
• https://github.com/py-pdf/pypdf · Note