CVE-2022-24859: PyPDF2 PDF Content Stream Infinite Loop
Summary
CVE-2022-24859: PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. Affects pypdf2 versions < 1.27.5. Fixed in 1.27.5. How to fix ↓
Also tracked for
- pypdf2 · Debian:11
The same CVE-2022-24859 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyPDF2 is an open source Python library that provides functionality for manipulating PDF files. It allows users to perform operations such as splitting, merging, cropping, and transforming the pages of PDF files. This vulnerability affects versions prior to 1.27.5 of the PyPDF2 library.
Vulnerability Detail
The vulnerability in PyPDF2 arises from an issue in the ContentStream._readInlineImage function. In affected versions, an attacker can craft a malicious PDF file that triggers an infinite loop when the code attempts to retrieve the content stream. The while-loop in the function only terminates when it encounters the EI token, but it fails to check if the stream has already ended. This can lead to resource exhaustion and denial of service (DoS) if the code attempts to iterate over the content stream indefinitely. The vulnerability has been assigned the identifier CVE-2022-24859.
How To Fix
Latest published version: 3.0.1 as of 23 Oct 2026
pip install --upgrade "pypdf2==3.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.27.5
This is the first release that contains the fix.
pip install --upgrade "pypdf2==1.27.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of the PyPDF2 library.
Conclusion
The CVE-2022-24859 vulnerability in PyPDF2 allows an attacker to craft a malicious PDF file that triggers an infinite loop, leading to denial of service. Users are advised to upgrade to version 1.27.5 or later of the PyPDF2 library to mitigate this vulnerability. If upgrading is not feasible, validating PDF files before iterating over their content stream is recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pypdf2 →
FAQ
PyPDF2 is a Python library that allows manipulation of PDF files, including operations like splitting, merging, cropping, and transforming pages.
Versions prior to 1.27.5 of the PyPDF2 library are affected.
An attacker can craft a malicious PDF file that triggers an infinite loop, leading to resource exhaustion and denial of service (DoS) if the code attempts to iterate over the content stream indefinitely.
Yes, the vulnerability has been fixed in version 1.27.5 of the PyPDF2 library.
If upgrading is not possible, it is recommended to validate PDF files before iterating over their content stream to ensure they do not trigger the infinite loop.
Related vulnerabilities
Recent vulnerabilities recorded for pypdf2.
