{"id":"CVE-2022-24859","aliases":["DEBIAN-CVE-2022-24859","DLA-3039-1","DLA-3451-1","EUVD-2022-0214","GHSA-xcjx-m2pj-8g79","MGASA-2022-0224","PYSEC-2022-194","UBUNTU-CVE-2022-24859","USN-6176-1","openSUSE-SU-2024:0366-1"],"status":"published","title":"Manipulated inline images can cause Infinite Loop in PyPDF2","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01328,"percentile":0.71247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2022-04-18T00:00:00Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"PyPI","package":"pypdf2","fixed_in":["1.27.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pypdf2","fixed_in":["1.27.9-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"pypdf2","fixed_in":["1.26.0-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"pypdf2","fixed_in":["1.26.0-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-pypdf2","fixed_in":["1.27.5-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","fixed_in":["1.25.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","fixed_in":["1.26.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","fixed_in":["1.26.0-3ubuntu1.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","fixed_in":["1.26.0-4ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"python-PyPDF2","fixed_in":["1.26.0-bp156.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-PyPDF2","fixed_in":["1.26.0-bp156.4.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2+deb9u1"}]}],"versions":["1.26.0-2"]},{"source":"osv","ecosystem":"Debian:10","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2+deb10u1"}]}],"versions":["1.26.0-2"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5"}]}],"versions":["1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.25.1","1.26.0","1.27.0","1.27.1","1.27.2","1.27.3","1.27.4"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5"}]}],"versions":["1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.25.1","1.26.0","1.27.0","1.27.1","1.27.2","1.27.3","1.27.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1ubuntu0.1~esm1"}]}],"versions":["1.23+git20141008-1","1.25.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2ubuntu0.1~esm1"}]}],"versions":["1.26.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-3ubuntu1.20.04.1"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-4ubuntu0.22.04.1"}]}],"versions":["1.26.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1ubuntu0.1~esm1"}]}],"versions":["1.23+git20141008-1","1.25.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2ubuntu0.1~esm1"}]}],"versions":["1.26.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-3ubuntu1.20.04.1"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-4ubuntu0.22.04.1"}]}],"versions":["1.26.0-4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"python-PyPDF2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-bp156.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-PyPDF2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-bp156.4.3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"py-pdf","product":"pypdf2"},{"vendor":"pypdf2_project","product":"pypdf2"}],"references":[{"url":"https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/py-pdf/PyPDF2/issues/329","tags":["x_transferred","Exploit","Third Party Advisory","report","web"]},{"url":"https://github.com/py-pdf/PyPDF2/pull/740","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24859","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pypdf2/PYSEC-2022-194.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xcjx-m2pj-8g79"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24859.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24859","tags":["advisory"]},{"url":"https://github.com/py-pdf/PyPDF2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0224.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30511","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3039","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-24859","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6176-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24859","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JXAHSUMAQ6VKWEA3MS762SNZWXCCD54L/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198588","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24859","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24859","title":"Manipulated inline images can cause Infinite Loop in PyPDF2","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T00:00:00Z","modified":"2025-04-22T18:15:17.46Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-0214","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T00:00:00Z","modified":"2025-04-22T18:15:17Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"ghsa":[{"id":"GHSA-xcjx-m2pj-8g79","title":"Manipulated inline images can cause Infinite Loop in PyPDF2","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:\n\n```python\nfrom PyPDF2 import PdfFileReader, PdfFileWriter\nfrom PyPDF2.pdf import ContentStream\n\nreader = PdfFileReader(\"malicious.pdf\", strict=False)\nfor page in reader.pages:\n    ContentStream(page.getContents(), reader)\n```\n\n### Patches\n\n[`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched.\n\nCredits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.\n","status":"published","published":"2022-04-22T20:54:41Z","modified":"2024-10-14T16:49:23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2022-24859","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T19:15:09.757Z","modified":"2026-06-17T04:32:40.613Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"CVE-2022-24859","title":"Manipulated inline images can cause Infinite Loop in PyPDF2","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T00:00:00Z","modified":"2026-10-28T02:30:32.298517702Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24859","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T19:15:09.757Z","modified":"2026-11-03T08:02:44.09866778Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-xcjx-m2pj-8g79","title":"Manipulated inline images can cause Infinite Loop in PyPDF2","description":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:\n\n```python\nfrom PyPDF2 import PdfFileReader, PdfFileWriter\nfrom PyPDF2.pdf import ContentStream\n\nreader = PdfFileReader(\"malicious.pdf\", strict=False)\nfor page in reader.pages:\n    ContentStream(page.getContents(), reader)\n```\n\n### Patches\n\n[`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched.\n\nCredits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.\n","status":"published","published":"2022-04-22T20:54:41Z","modified":"2024-10-14T18:55:47.08953Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2022-24859","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T19:15:00Z","modified":"2026-02-04T02:19:58.291127Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3039-1","title":"pypdf2 - security update","status":"published","published":"2022-06-03T00:00:00Z","modified":"2026-03-09T01:18:02.250143Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3451-1","title":"pypdf2 - security update","status":"published","published":"2023-06-09T00:00:00Z","modified":"2026-03-09T01:18:11.043402Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0224","title":"Updated python-pypdf2 packages fix security vulnerability","description":"Infinite loop with manipulated inline images (CVE-2022-24859)\n","status":"published","published":"2022-06-09T20:49:47Z","modified":"2026-04-16T04:42:53.26348861Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:0366-1","title":"Security update for python-PyPDF2","description":"This update for python-PyPDF2 fixes the following issues:\n\n- CVE-2022-24859: Fixed infinite loop vulnerability (boo#1198588)\n","status":"published","published":"2024-11-12T17:01:19Z","modified":"2026-02-04T04:04:47.184092Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"PYSEC-2022-194","description":"PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.","status":"published","published":"2022-04-18T19:15:00Z","modified":"2023-11-08T04:08:38.867416Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"USN-6176-1","title":"pypdf2 vulnerability","description":"It was discovered that PyPDF2 incorrectly handled certain PDF files. If a \nuser or automated system were tricked into processing a specially crafted\nfile, an attacker could possibly use this issue to consume system\nresources, resulting in a denial of service.\n","status":"published","published":"2023-06-19T05:54:25Z","modified":"2026-06-25T13:32:09.280507374Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}