CVE catalog

CVE-2022-24859

pypdf2 affected and fixed versions

[CVE catalog]

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.33% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debianbookwormpypdf21.27.9-1FixedDistribution-reported fixed boundary[CVE-2022-24859]
Debianbookwormpypdf22.12.1-3+deb12u1Fixed[CVE-2022-24859]

Showing 2 fix observations. All 11 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormpypdf21.27.9-1FixedDistribution-reported fixed boundary[CVE-2022-24859]
Debianbookwormpypdf22.12.1-3+deb12u1Fixed[CVE-2022-24859]
Opensuseleap 15.6python-PyPDF21.26.0-bp156.4.3.1UnknownSource applicability is not established[OPENSUSE-SU-2024:0366-1]
Susepackage hub 15 sp6python-PyPDF21.26.0-bp156.4.3.1UnknownSource applicability is not established[OPENSUSE-SU-2024:0366-1]
Ubuntu20.04pypdf21.26.0-2UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntu20.04pypdf21.26.0-3ubuntu1UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntu20.04pypdf21.26.0-3ubuntu1.20.04.1UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntu22.04pypdf21.26.0-4UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntu22.04pypdf21.26.0-4ubuntu0.22.04.1UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntupropypdf21.26.0-2UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Ubuntupropypdf21.26.0-2ubuntu0.1~esm1UnknownSource applicability is not established[USN-6176-1][UBUNTU-CVE-2022-24859]
Original provider fields
{
  "package_releases": [
    {
      "name": "pypdf2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.12.1-3+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1009879,
      "name": "pypdf2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.27.9-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-2ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.26.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6176-1",
      "fixed_version": "1.26.0-2ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6176-1",
      "provider_updated_at": "2026-06-25T13:32:09.280507374Z",
      "applicability_unknown": true
    },
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-3ubuntu1.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.26.0-2",
        "1.26.0-3ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6176-1",
      "fixed_version": "1.26.0-3ubuntu1.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6176-1",
      "provider_updated_at": "2026-06-25T13:32:09.280507374Z",
      "applicability_unknown": true
    },
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-4ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.26.0-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6176-1",
      "fixed_version": "1.26.0-4ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6176-1",
      "provider_updated_at": "2026-06-25T13:32:09.280507374Z",
      "applicability_unknown": true
    },
    {
      "name": "python-PyPDF2",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-bp156.4.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0366-1",
      "fixed_version": "1.26.0-bp156.4.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0366-1",
      "provider_updated_at": "2026-02-04T04:04:47.184092Z",
      "applicability_unknown": true
    },
    {
      "name": "python-PyPDF2",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-bp156.4.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0366-1",
      "fixed_version": "1.26.0-bp156.4.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0366-1",
      "provider_updated_at": "2026-02-04T04:04:47.184092Z",
      "applicability_unknown": true
    },
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-2ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.26.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24859",
      "fixed_version": "1.26.0-2ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24859",
      "provider_updated_at": "2026-02-04T02:19:58.291127Z",
      "applicability_unknown": true
    },
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-3ubuntu1.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.26.0-2",
        "1.26.0-3ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24859",
      "fixed_version": "1.26.0-3ubuntu1.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24859",
      "provider_updated_at": "2026-02-04T02:19:58.291127Z",
      "applicability_unknown": true
    },
    {
      "name": "pypdf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-4ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.26.0-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24859",
      "fixed_version": "1.26.0-4ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24859",
      "provider_updated_at": "2026-02-04T02:19:58.291127Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1009879]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [python3-pypdf2]Unknown

    Source package: [pypdf2]

    Details (2)

    • 2.12.1-3+deb12u1 · all · bookworm

      Fixed · Fixed: 1.27.9-1

      dsa · pypdf2 · debian · bookworm

    • 2.12.1-3+deb12u1 · all · bookworm

      Fixed · Fixed: 1.27.9-1

      dsa · pypdf2 · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]