CVE-2023-46250: pypdf - Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
Summary
CVE-2023-46250: Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF. Affects pypdf versions >= 3.7.0, < 3.17.0. Fixed in 3.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library that provides functionality for reading, manipulating, and creating PDF files. It is commonly used for tasks such as merging PDFs, adding annotations, and extracting text from PDF documents. This vulnerability affects versions 3.7.0 to 3.17.0 of pypdf. The vulnerability allows an attacker to craft a malicious PDF that triggers an infinite loop when processed by PdfWriter(clone_from) function. This loop can consume 100% CPU utilization on a single core, causing a denial of service. The vulnerability does not impact memory usage.
Vulnerability Detail
The vulnerability arises when pypdf processes a specially crafted PDF file. By manipulating the PDF, such as merging it with another PDF or adding annotations, an attacker can trigger an infinite loop in the PdfWriter(clone_from) function. This loop blocks the current process and can cause high CPU usage. The impact of this vulnerability is a denial of service, as the affected process becomes unresponsive. The issue was fixed with the release of version 3.17.0 of pypdf.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.17.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==3.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the patched version is not possible, a workaround is available. The file pypdf/generic/_data_structures.py should be modified as described in the fix #2264. The specific changes can be found in the GitHub advisory.
Conclusion
The pypdf library is vulnerable to an infinite loop issue when processing a specially crafted PDF. This can lead to high CPU usage and a denial of service. It is recommended to update to version 3.17.0 or later to fix the vulnerability. If updating is not possible, follow the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pypdf →
FAQ
pypdf is a Python library for working with PDF files. It provides functionality for reading, manipulating, and creating PDF documents.
The vulnerability allows an attacker to craft a malicious PDF that triggers an infinite loop, causing high CPU usage and a denial of service.
To fix this vulnerability, update pypdf to version 3.17.0 or later. Ensure that any dependencies or applications using pypdf are also updated.
If updating to the patched version is not possible, a workaround is available. Modify the file pypdf/generic/_data_structures.py as described in the fix #2264.
No, this vulnerability only affects CPU usage. Memory usage remains unaffected.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
