{"vulnerability": "cve-2026-5465", "sightings": [{"uuid": "9651c6b0-bb4c-4edc-bd2f-e7d92a003c6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5465", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mivcqtypg327", "content": "", "creation_timestamp": "2026-04-07T08:01:05.532293Z"}, {"uuid": "bd34a81f-c435-4e21-adbf-03c186f50470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5465", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mivi5ssztu2s", "content": "", "creation_timestamp": "2026-04-07T09:37:20.153279Z"}, {"uuid": "fb8b43ed-4e8e-4b52-93f7-229f98d7de9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5465", "type": "seen", "source": "https://t.me/GithubRedTeam/79257", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5465\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-07 13:59:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-07T14:00:04.000000Z"}, {"uuid": "3e7a28f4-812b-4bd1-8f1f-122642ec3189", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5465", "type": "published-proof-of-concept", "source": "Telegram/0sm8ATZ7rNPvlZx6vGLi3K-krzdNfmL8FWYus3NVMcNSJdo", "content": "", "creation_timestamp": "2026-04-07T15:00:16.000000Z"}, {"uuid": "e580ac7a-dab3-416e-95ae-7e1523eb4d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5465", "type": "seen", "source": "Telegram/UjrnvOa2JLE3qzXsFYe7vk49vQcInvR-SenKatBboIQ7n94", "content": "", "creation_timestamp": "2026-04-07T09:15:25.000000Z"}, {"uuid": "ebdddcfc-74ba-4e35-b9a9-ac62a653fc9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54652", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nqwlaj32q", "content": "CVE-2026-54652 - Frigate viewer can read logs exposing admin and camera credentials\nCVE ID : CVE-2026-54652\n \n Published : July 8, 2026, 3:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{...", "creation_timestamp": "2026-07-08T17:35:09.363684Z"}, {"uuid": "b4ba8120-bc88-45c6-9480-ff4cb68fbba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54651", "type": "seen", "source": "https://gist.github.com/alon710/29f907693324d6187f6b141f2c73d47b", "content": "# CVE-2026-54651: CVE-2026-54651: Infinite Loop Vulnerability in pypdf Article Thread Parser\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-07-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54651\n\n## Summary\nAn infinite loop vulnerability exists in the pure-Python PDF library pypdf prior to version 6.13.1. When parsing or merging a crafted PDF file containing a cyclic Article/Thread structure, the library fails to exit its traversal loop. This causes the executing thread to hang indefinitely, leading to 100% CPU utilization and a denial of service. The vulnerability is tracked under CVE-2026-54651 and GHSA-g9xf-7f8q-9mcj, with a CVSS base score of 5.5. This technical report provides a root cause analysis, code review, exploitation vectors, and mitigation paths.\n\n## TL;DR\nA denial-of-service vulnerability in pypdf (< 6.13.1) allows attackers to trigger 100% CPU starvation by uploading a PDF containing cyclic Article structure definitions. The parser fails to detect sub-loops within the Thread linked list, resulting in an infinite execution loop. Upgrading to version 6.13.1 implements a visited-set lookup that mitigates this risk.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835 (Loop with Unreachable Exit Condition)\n- **Attack Vector**: Local / File Parsing (AV:L)\n- **CVSS Score**: 5.5 (Medium, CVSS v3.1) / 6.9 (Medium, CVSS v4.0)\n- **EPSS Score**: 0.00111 (Percentile: 1.58%)\n- **Impact**: Denial of Service via 100% CPU starvation\n- **Exploit Status**: PoC documented, non-weaponized\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pypdf library installations prior to version 6.13.1\n- Web applications utilizing pypdf to merge, append, or modify untrusted PDF files\n- **pypdf**: < 6.13.1 (Fixed in: `6.13.1`)\n\n## Mitigation\n\n- Upgrade pypdf to version 6.13.1 or higher.\n- Configure process-level execution timeouts to automatically kill hung worker threads.\n- Add defensive error handling to catch LimitReachedError exceptions in the application code.\n- Implement CPU resource limits on parsing containers to isolate resource exhaustion.\n\n**Remediation Steps:**\n1. Audit the software bill of materials (SBOM) and requirement configuration files to identify vulnerable pypdf installations.\n2. Update dependencies in requirements.txt or poetry.lock to require pypdf >= 6.13.1.\n3. Implement a try-except structure enclosing PDF modification operations to trap the LimitReachedError.\n4. Deploy updated software containers and verify execution limits are enforced in the orchestration environment.\n\n## References\n\n- [GitHub Pull Request #3839](https://github.com/py-pdf/pypdf/pull/3839)\n- [pypdf 6.13.1 Release Changelog](https://github.com/py-pdf/pypdf/releases/tag/6.13.1)\n- [GitHub Security Advisory GHSA-g9xf-7f8q-9mcj](https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj)\n- [Fix Commit 5efe472](https://github.com/py-pdf/pypdf/commit/5efe472b07e36d1ae22c9991d744d013cfb2f214)\n- [NVD CVE-2026-54651 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54651)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54651) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-09T21:41:51.037198Z"}]}