CVE-2026-8318
Infinite Loop in VectifyAI PageIndex PDF Table of Contents Handler
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vectifyai | pageindex | to f50e52975313c6716c02b20a119577a1929decba (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include limiting or blocking the processing of PDFs with excessively long or crafted Table of Contents that could trigger the infinite loop.
Monitor and restrict API usage to prevent rapid depletion of API credits caused by the infinite loop.
Implement resource limits such as CPU usage caps or process timeouts on the PageIndex application to prevent denial of service.
If possible, update or patch the application to use a version of the toc_transformer function that includes iteration limits or exit conditions similar to the patched extract_toc_content function which caps attempts at five.
Until an official patch is available, consider disabling or restricting the use of the PDF Table of Contents Handler component to avoid triggering the vulnerability.
Can you explain this vulnerability to me?
The CVE-2026-8318 vulnerability is an arbitrary infinite loop Denial of Service (DoS) attack in the VectifyAI PageIndex package. It occurs in the toc_transformer function of the PDF Table of Contents Handler component. The function uses a Large Language Model (LLM) to convert a raw Table of Contents string into a hierarchical JSON format. If the LLM's response is truncated due to exceeding the maximum output token limit, the function attempts to continue processing by requesting more content. However, the while loop controlling this process lacks any iteration limits or exit conditions, causing the application to enter an infinite loop.
This infinite loop continuously queries the backend LLM API, consuming 100% of a CPU thread and rapidly depleting API credits, which leads to service unavailability and potential financial loss. The vulnerability can be triggered remotely by crafting a malicious PDF with an excessively long Table of Contents or by using a mock proxy to force truncated LLM responses.
How can this vulnerability impact me? :
This vulnerability can cause a Denial of Service (DoS) by making the affected application enter an infinite loop that consumes 100% CPU resources. This results in the service becoming unavailable to legitimate users.
Additionally, the continuous querying of the backend LLM API can rapidly deplete API credits, potentially causing unexpected financial costs.
Overall, the impact includes service downtime, degraded performance, and increased operational expenses.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as an infinite loop in the toc_transformer function of the PageIndex package, causing 100% CPU usage on a thread and rapid depletion of API credits due to continuous backend LLM API queries.
To detect this vulnerability on your system, monitor for unusually high CPU usage by the PageIndex process, especially sustained 100% CPU consumption on a single thread.
Additionally, monitor network traffic for excessive or repeated API calls to the backend LLM service originating from the PageIndex application.
- Use system monitoring commands like `top` or `htop` on Linux to observe CPU usage by the PageIndex process.
- Use `ps aux | grep pageindex` to identify the process and check its CPU consumption.
- Use network monitoring tools such as `netstat -anp | grep <pageindex_pid>` or `iftop` to observe network connections and traffic volume.
- Check application logs for repeated or continuous calls to the LLM API or errors related to the toc_transformer function.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability causes an infinite loop Denial of Service (DoS) attack that can lead to service unavailability and financial loss by exhausting CPU resources and API credits.
However, there is no information provided about any impact on data confidentiality, integrity, or privacy that would directly affect compliance with standards such as GDPR or HIPAA.
Therefore, based on the available information, this vulnerability primarily affects availability but does not explicitly indicate violations or risks related to common regulatory compliance requirements.