pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. PatchesThis has been fixed in pypdf==6.9.2. WorkaroundsIf users cannot upgrade yet, consider applying the changes from PR 3693...

Denial-of-service (DoS)

pypdf is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of PDFs missing the /Root object with a large /Size value in non-strict parsing mode, which allows an attacker to craft an invalid PDF that triggers excessively long runtimes...