Pdfly: pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream (CVE-2026-33699)
A vulnerability in the pdfly product's pypdf component allows an attacker to craft a malicious PDF that causes an infinite loop during recovery attempts in the DictionaryObject.read_from_stream function when reading files in non-strict mode. This issue has been fixed in pypdf version 6.9.2.
AI Analysis
Technical Summary
CVE-2026-33699 describes a vulnerability in pdfly's pypdf library where an attacker can create a specially crafted PDF file that triggers an infinite loop during the recovery process in the DictionaryObject.read_from_stream method. This occurs only when the PDF is read in non-strict mode. The vulnerability has been addressed and fixed in pypdf version 6.9.2. For users unable to upgrade immediately, applying the changes from pull request #3693 is recommended as a workaround.
Potential Impact
An attacker can cause a denial of service by crafting a PDF that triggers an infinite loop in the affected function, potentially leading to resource exhaustion or application unavailability. This requires the PDF to be processed in non-strict mode. There is no indication of privilege escalation, data disclosure, or remote code execution.
Mitigation Recommendations
Upgrade to pypdf version 6.9.2 or later, where this vulnerability is fixed. If upgrading is not immediately possible, apply the changes from pull request #3693 as a temporary workaround.
Pdfly: pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream (CVE-2026-33699)
Description
A vulnerability in the pdfly product's pypdf component allows an attacker to craft a malicious PDF that causes an infinite loop during recovery attempts in the DictionaryObject.read_from_stream function when reading files in non-strict mode. This issue has been fixed in pypdf version 6.9.2.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-33699 describes a vulnerability in pdfly's pypdf library where an attacker can create a specially crafted PDF file that triggers an infinite loop during the recovery process in the DictionaryObject.read_from_stream method. This occurs only when the PDF is read in non-strict mode. The vulnerability has been addressed and fixed in pypdf version 6.9.2. For users unable to upgrade immediately, applying the changes from pull request #3693 is recommended as a workaround.
Potential Impact
An attacker can cause a denial of service by crafting a PDF that triggers an infinite loop in the affected function, potentially leading to resource exhaustion or application unavailability. This requires the PDF to be processed in non-strict mode. There is no indication of privilege escalation, data disclosure, or remote code execution.
Mitigation Recommendations
Upgrade to pypdf version 6.9.2 or later, where this vulnerability is fixed. If upgrading is not immediately possible, apply the changes from pull request #3693 as a temporary workaround.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-pdfly-CVE-2026-33699
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac1396fa43b0b3b89d5fdfd
Added to database: 10/03/2026, 17:20:47 UTC
Last enriched: 10/03/2026, 17:26:45 UTC
Last updated: 10/04/2026, 02:46:04 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.