Which versions of pypdf are affected by CVE-2026-59935?

pypdf is widely deployed in organizational document-processing and data-ingestion infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-59935?

Within 24 hours: Identify all applications and services using pypdf and assess exposure. Within 7 days: Update pypdf to version 6.14.2 or later and redeploy affected services. Within 30 days: Deploy monitoring for CPU anomalies on document-processing workers and implement rate-limiting on PDF parsing.

pypdf CVE-2026-59935

Q: What is the CVSS score of CVE-2026-59935?

CVE-2026-59935 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42365 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-08 GitHub_M

GHSA-g867-7843-wf8q

Python Denial Of Service Pypdf Red Hat Suse

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Untrusted PDF processed by server-side pipelines gives AV:N/PR:N/UI:N with low complexity; impact is a pure availability hang, so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:28 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 pypi packages depend on pypdf (12 direct, 2 indirect)

Ecosystem-wide dependent count for version 6.14.2.

DescriptionCVE.org

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 2 Critical, 8 High, 1 With POC Jul 09, 2026

AnalysisAI

Denial of service in pypdf before 6.14.2 lets a remote attacker hang any application that parses an attacker-supplied PDF: a page content stream carrying an unterminated inline image with an ASCII85 or ASCIIHex filter drives the parser into an infinite loop (CWE-835), most notably during page text extraction. The pure-Python library is very widely used in document-processing and data-ingestion pipelines, so a single malicious file can pin a CPU core and stall the worker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well-described and trivially reproducible.

Technical ContextAI

pypdf is a pure-Python library for reading, writing, and manipulating PDFs, commonly embedded in web backends, OCR/text-extraction pipelines, and ETL jobs. The flaw lives in the content-stream parser that decodes inline images (the PDF 'BI ... ID ... EI' construct). Inline image data can be wrapped in stream filters such as ASCII85Decode (/A85) or ASCIIHexDecode (/AHx); when the image is never properly terminated, the decoder loop that scans for the end-of-data marker never reaches its exit condition. This is a textbook CWE-835 (Loop with Unreachable Exit Condition / 'Infinite Loop'): the parser keeps consuming without ever satisfying the termination test, so the process spins indefinitely. The affected component is identified by CPE cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:* for all versions prior to 6.14.2.

RemediationAI

Vendor-released patch: upgrade pypdf to 6.14.2 or later (pip install --upgrade 'pypdf>=6.14.2'), which fixes the unterminated-inline-image parsing loop; the fix is in PR https://github.com/py-pdf/pypdf/pull/3892 and commit 5a33a46416aa1ae6c025ff90a3cca57631fdafd2, described in advisory https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q. If you cannot upgrade immediately, run pypdf parsing and text extraction in a separate worker process with a hard wall-clock timeout and CPU/memory limits so a hung parse can be killed and recycled rather than pinning your main service - the trade-off is added process-management overhead and latency. Where feasible, constrain or reject attacker-supplied PDFs (size limits, sandboxed execution) before extraction; note this reduces but does not eliminate exposure since the trigger is a small malformed structure, not a large file. These are compensating controls only - patching to 6.14.2 is the durable fix.