Add CVSS 3.1 score for GHSA-2q4j-m29v-hq73 (pypdf Infinite Loop)

[sunnypatell]

Changes

Added missing CVSS 3.1 scoring to GHSA-2q4j-m29v-hq73 (pypdf Infinite Loop when Processing Bookmarks).

Added:

• CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)

Reason for change

This advisory had no CVSS 3.1 score and was marked as "MODERATE" severity, but NVD's CVSS 3.1 assessment scores it 7.5 HIGH. Adding the CVSS 3.1 vector provides more accurate severity context for downstream consumers.

CVSS justification

• AV:N because crafted PDFs can be received from any network source (web uploads, email attachments, API endpoints)
• AC:L because the infinite loop triggers reliably when processing any PDF with circular outline/bookmark references
• PR:N because no authentication is required to submit a crafted PDF to a processing service
• UI:N because PDF processing is typically automated (document pipelines, upload handlers, indexing services)
• C:N/I:N because the vulnerability only causes a hang, not data disclosure or modification
• A:H because the infinite loop permanently hangs the processing thread, causing denial of service

The GHSA severity label says "MODERATE" but CVSS 3.1 scoring from NVD rates this as HIGH (7.5). The discrepancy likely comes from the existing CVSS 4.0 vector which uses AV:L (local), but in practice PDFs are received and processed over the network.

Supporting links

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-24688
• Fix PR: SEC: Detect cyclic references when retrieving outlines py-pdf/pypdf#3610
• Fix commit: py-pdf/pypdf@b1282f8

[Copilot]

Pull request overview

Adds the missing CVSS 3.1 score/vector to the GHSA advisory for the pypdf outlines/bookmarks infinite-loop DoS, aligning the advisory with NVD’s CVSS 3.1 assessment.

Changes:

• Added a CVSS 3.1 severity entry (CVSS_V3) with the provided vector/score string.
• Kept the existing CVSS 4.0 severity entry intact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.