{"id":"CVE-2023-36464","aliases":["DEBIAN-CVE-2023-36464","EUVD-2023-1690","GHSA-4vvm-4w3v-6mr8","PYSEC-2026-1835","PYSEC-2026-3008","RHLW-2026-821eaab8409c2a61","ROOT-APP-PYPI-CVE-2023-36464","UBUNTU-CVE-2023-36464"],"status":"published","title":"Infinite Loop when a comment isn't followed by a character in pypdf","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00352,"percentile":0.29296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2023-06-27T21:24:30Z","modified":"2026-11-04T10:45:19Z","fixes":[{"ecosystem":"PyPI","package":"pypdf","fixed_in":["3.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pypdf","fixed_in":["3.4.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pypdf","fixed_in":["3.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pypdf","fixed_in":["3.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pypdf2","fixed_in":["2.12.1-3+deb12u1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"pypdf2","fixed_in":["3.9.0"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:PyPI","package":"pypdf2","fixed_in":["3.0.1+rhlw.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-PyPDF2","fixed_in":["3.0.1+root.io.1","3.0.1+root.io.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"PyPDF2","fixed_in":["3.0.1+aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.9.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"3.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1+deb12u1"}]}],"versions":["3.4.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-3+deb12u1"}]}],"versions":["2.12.1-3"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.9.0"}]}],"versions":["3.1.0","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"3.0.1"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.10.8","2.10.9","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"3.9.0"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.10.8","2.10.9","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.9.0"}]}],"versions":["3.1.0","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1+rhlw.1"}]}],"versions":["1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.25.1","1.26.0","1.27.0","1.27.1","1.27.10","1.27.11","1.27.12","1.27.2","1.27.3","1.27.4","1.27.5","1.27.6","1.27.7","1.27.8","1.27.9","1.28.0","1.28.1","1.28.2","1.28.3","1.28.4","1.28.5","1.28.6","2.0.0","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.10.8","2.10.9","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.0.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-PyPDF2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1+root.io.1"},{"fixed":"3.0.1+root.io.2"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"PyPDF2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1+aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1-1","3.17.4-1","4.0.0-1","4.0.1-1","4.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-1","5.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pypdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.9.2-1"]}],"products":[{"vendor":"py-pdf","product":"pypdf"},{"vendor":"pypdf2_project","product":"pypdf2"}],"references":[{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","advisory","web","report"]},{"url":"https://github.com/py-pdf/pypdf/pull/1828","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/py-pdf/pypdf/pull/969","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36464","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf/commit/b0e5c689df689ab173df84dacd77b6fc3c161932","tags":["web","fix"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/3.9.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4vvm-4w3v-6mr8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36464.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-36464","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf","tags":["package"]},{"url":"https://pypi.org/project/pypdf2","tags":["package"]},{"url":"https://pypi.org/project/pypdf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-36464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36464","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-36464","title":"Infinite Loop when a comment isn't followed by a character in pypdf","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T21:24:30.685Z","modified":"2024-12-03T16:56:06.186Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:35:27.810438Z"}],"euvd":[{"id":"EUVD-2023-1690","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T21:24:30Z","modified":"2024-12-03T16:56:06Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:42.176683Z"}],"ghsa":[{"id":"GHSA-4vvm-4w3v-6mr8","title":"pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.\n\nExample Code and a PDF that causes the issue:\n\n```python\nfrom pypdf import PdfReader\n\n# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20230627T201018Z\u0026X-Amz-Expires=300\u0026X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2\u0026X-Amz-SignedHeaders=host\u0026actor_id=1658117\u0026key_id=0\u0026repo_id=3119517\u0026response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf\u0026response-content-type=application%2Fpdf\nreader = PdfReader(\"MiFO_LFO_FEIS_NOA_Published.3.pdf\")\npage = reader.pages[0]\npage.extract_text()\n```\n\nThe issue was introduced with https://github.com/py-pdf/pypdf/pull/969\n\n### Patches\n\nThe issue was fixed with https://github.com/py-pdf/pypdf/pull/1828\n\n### Workarounds\n\nIt is recommended to upgrade to `pypdf\u003e=3.9.0`. PyPDF2 users should migrate to pypdf.\n\nIf you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:\n\n```\nOLD: while peek not in (b\"\\r\", b\"\\n\"):\nNEW: while peek not in (b\"\\r\", b\"\\n\", b\"\"):\n```","status":"published","published":"2023-06-30T20:33:57Z","modified":"2023-11-11T05:03:14Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:20.311836Z"}],"nvd":[{"id":"CVE-2023-36464","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T22:15:11.79Z","modified":"2026-11-02T16:06:04.477Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"CVE-2023-36464","title":"Infinite Loop when a comment isn't followed by a character in pypdf","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T21:24:30.685Z","modified":"2026-11-04T10:45:19.969856892Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-04T11:07:20.833685Z"},{"id":"DEBIAN-CVE-2023-36464","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T22:15:11.79Z","modified":"2026-11-03T09:47:33.478104796Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-4vvm-4w3v-6mr8","title":"pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.\n\nExample Code and a PDF that causes the issue:\n\n```python\nfrom pypdf import PdfReader\n\n# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20230627T201018Z\u0026X-Amz-Expires=300\u0026X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2\u0026X-Amz-SignedHeaders=host\u0026actor_id=1658117\u0026key_id=0\u0026repo_id=3119517\u0026response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf\u0026response-content-type=application%2Fpdf\nreader = PdfReader(\"MiFO_LFO_FEIS_NOA_Published.3.pdf\")\npage = reader.pages[0]\npage.extract_text()\n```\n\nThe issue was introduced with https://github.com/py-pdf/pypdf/pull/969\n\n### Patches\n\nThe issue was fixed with https://github.com/py-pdf/pypdf/pull/1828\n\n### Workarounds\n\nIt is recommended to upgrade to `pypdf\u003e=3.9.0`. PyPDF2 users should migrate to pypdf.\n\nIf you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:\n\n```\nOLD: while peek not in (b\"\\r\", b\"\\n\"):\nNEW: while peek not in (b\"\\r\", b\"\\n\", b\"\"):\n```","status":"published","published":"2023-06-30T20:33:57Z","modified":"2026-09-10T03:50:01.918644849Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"PYSEC-2026-1835","title":"pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.\n\nExample Code and a PDF that causes the issue:\n\n```python\nfrom pypdf import PdfReader\n\n# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20230627T201018Z\u0026X-Amz-Expires=300\u0026X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2\u0026X-Amz-SignedHeaders=host\u0026actor_id=1658117\u0026key_id=0\u0026repo_id=3119517\u0026response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf\u0026response-content-type=application%2Fpdf\nreader = PdfReader(\"MiFO_LFO_FEIS_NOA_Published.3.pdf\")\npage = reader.pages[0]\npage.extract_text()\n```\n\nThe issue was introduced with https://github.com/py-pdf/pypdf/pull/969\n\n### Patches\n\nThe issue was fixed with https://github.com/py-pdf/pypdf/pull/1828\n\n### Workarounds\n\nIt is recommended to upgrade to `pypdf\u003e=3.9.0`. PyPDF2 users should migrate to pypdf.\n\nIf you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:\n\n```\nOLD: while peek not in (b\"\\r\", b\"\\n\"):\nNEW: while peek not in (b\"\\r\", b\"\\n\", b\"\"):\n```","status":"published","published":"2026-07-07T11:45:19.59516Z","modified":"2026-07-13T16:42:55.319975462Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"PYSEC-2026-3008","title":"pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.\n\nExample Code and a PDF that causes the issue:\n\n```python\nfrom pypdf import PdfReader\n\n# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20230627T201018Z\u0026X-Amz-Expires=300\u0026X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2\u0026X-Amz-SignedHeaders=host\u0026actor_id=1658117\u0026key_id=0\u0026repo_id=3119517\u0026response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf\u0026response-content-type=application%2Fpdf\nreader = PdfReader(\"MiFO_LFO_FEIS_NOA_Published.3.pdf\")\npage = reader.pages[0]\npage.extract_text()\n```\n\nThe issue was introduced with https://github.com/py-pdf/pypdf/pull/969\n\n### Patches\n\nThe issue was fixed with https://github.com/py-pdf/pypdf/pull/1828\n\n### Workarounds\n\nIt is recommended to upgrade to `pypdf\u003e=3.9.0`. PyPDF2 users should migrate to pypdf.\n\nIf you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:\n\n```\nOLD: while peek not in (b\"\\r\", b\"\\n\"):\nNEW: while peek not in (b\"\\r\", b\"\\n\", b\"\"):\n```","status":"published","published":"2026-07-13T14:20:01.43033Z","modified":"2026-07-13T16:42:55.319975462Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"RHLW-2026-821eaab8409c2a61","title":"Lightwell Security Advisory: pypdf2 3.0.1+rhlw.1","description":"Red Hat Lightwell has released pypdf2 3.0.1+rhlw.1 with a backported security fix.\n\nCVE-2023-36464: Infinite Loop when a comment isn't followed by a character in pypdf\n\nThis patched artifact is a drop-in replacement for pypdf2 3.0.1 from PyPI.","status":"published","published":"2026-09-23T12:12:40Z","modified":"2026-10-27T04:00:11.338495911Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2023-36464","description":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`.","status":"published","published":"2023-06-27T22:15:00Z","modified":"2026-10-17T12:56:24.12270692Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"ROOT-APP-PYPI-CVE-2023-36464","title":"CVE-2023-36464 in rootio-PyPDF2 - Patched by Root","description":"Root has patched CVE-2023-36464 in the rootio-PyPDF2 package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T18:57:34Z","modified":"2026-06-04T02:00:18.509075274Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}