-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PyPDF2 | pip | = 2.10.5 | 2.10.6 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the 'read_object' function's control flow. The original code used a broad 'else' clause to handle number/indirect references without properly validating the input token first. The patch replaces this with explicit checks (elif tok in b"0123456789+-.") and adds an error case. This matches the workaround instructions and commit diff showing the critical fix in this function. The infinite loop occurs when unexpected tokens trigger repeated failed parsing attempts in this code path.