CVE catalog

CVE-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpypdfsid6.21.1-1fixed
Debianpypdfforky6.21.1-1fixed
Debianpypdftrixie5.4.0-1vulnerable
Debianpypdfbookworm3.4.1-1+deb12u1vulnerable
Debianpypdf2bookworm2.12.1-3+deb12u1vulnerable
CpepypdfNot reportedNot reportedvulnerable
Cpepypdf2Not reportedNot reportedvulnerable
CpepypdfNot reported6.9.2fixed
PyPIpypdfNot reported6.9.2fixed
Ubuntupypdf2pro1.26.0-2vulnerable
Ubuntupypdf2pro1.26.0-2ubuntu0.1~esm1vulnerable
Ubuntupypdf2pro1.26.0-2ubuntu0.1~esm2vulnerable
Ubuntupypdf220.041.26.0-2vulnerable
Ubuntupypdf220.041.26.0-3ubuntu1vulnerable
Ubuntupypdf220.041.26.0-3ubuntu1.20.04.1vulnerable
Ubuntupypdf220.041.26.0-3ubuntu1.20.04.2vulnerable
Ubuntupypdf222.041.26.0-4vulnerable
Ubuntupypdf222.041.26.0-4ubuntu0.22.04.1vulnerable
Ubuntupypdf222.041.26.0-4ubuntu0.22.04.2vulnerable
Ubuntupypdf24.043.4.1-1vulnerable
Ubuntupypdf24.043.17.4-1vulnerable
Ubuntupypdf24.044.0.0-1vulnerable
Ubuntupypdf24.044.0.1-1vulnerable
Ubuntupypdf24.044.0.2-1vulnerable
Ubuntupypdf224.042.12.1-3vulnerable
Ubuntupypdf224.042.12.1-4vulnerable
Ubuntupypdf25.104.3.1-1vulnerable
Ubuntupypdf25.105.4.0-1vulnerable
Ubuntupypdf26.045.4.0-1vulnerable
Ubuntupypdf26.046.9.2-1vulnerable
Opensusepython-pypdftumbleweed6.9.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpypdfsourcesid6.9.2-1not yet assignedNot reportedNot reported
Debianpypdfsourceforky6.9.2-1not yet assignedNot reportedNot reported
Debianpypdfsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianpypdfsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianpypdf2sourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpepypdfcpeNot reported6.9.2Not reportedNot reportedNot reported
PyPIpypdfPyPINot reported6.9.2Not reportedGHSA-87MJ-5GGW-8QC3Not reported
Opensusepython-pypdfrpmtumbleweed6.9.2-1.1Not reportedOPENSUSE-SU-2026:10464-1Not reported

Notes

[trixie] pypdf: Minor issue [bookworm] pypdf: Minor issue [bookworm] pypdf2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-pypdf]Affected

    Source package: [pypdf]

    Details (2)

    • 3.4.1-1+deb12u1 · all · bookworm

      Affected

      nvd · pypdf · debian · bookworm; nvd · pypdf · debian · 12

    • 3.4.1-1+deb12u1 · all · bookworm

      Affected

      nvd · pypdf · debian · bookworm; nvd · pypdf · debian · 12

  • [python3-pypdf2]Affected

    Source package: [pypdf2]

    Details (2)

    • 2.12.1-3+deb12u1 · all · bookworm

      Affected

      nvd · pypdf2 · debian · bookworm; nvd · pypdf2 · debian · 12

    • 2.12.1-3+deb12u1 · all · bookworm

      Affected

      nvd · pypdf2 · debian · bookworm; nvd · pypdf2 · debian · 12

[Debian 13 (Trixie)]

  • [python3-pypdf]Affected

    Source package: [pypdf]

    Details (2)

    • 5.4.0-1 · all · trixie

      Affected

      nvd · pypdf · debian · 13

    • 5.4.0-1 · all · trixie

      Affected

      nvd · pypdf · debian · 13

[openSUSE Tumbleweed]

  • [python313-pypdf]Unknown

    Source package: [python-pypdf]

    Details (1)

    • 6.16.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 6.9.2-1.1

      Version impact unknown

      nvd · python-pypdf · opensuse · tumbleweed

  • [python314-pypdf]Unknown

    Source package: [python-pypdf]

    Details (1)

    • 6.16.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 6.9.2-1.1

      Version impact unknown

      nvd · python-pypdf · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]