oxidize-pdf contains a vulnerability where non-finite floating-point values (NaN, infinity) can be used to construct color values that bypass clamping and result in invalid PDF content streams. This causes conformant PDF viewers to reject the affected pages or entire documents, leading to denial of service. The issue affects oxidize-pdf and its .NET and Python bindings. A patch is available in oxidize-pdf version 2.6.0 and corresponding updates in the bindings.