Which versions of pypdf are affected by CVE-2026-59936?

pypdf versions prior to 6.14.1 contain a denial of service vulnerability that allows unauthenticated attackers to hang applications by submitting malicious PDF files, particularly during text…. A patch is available.

How to fix or mitigate CVE-2026-59936?

Within 24 hours: Identify all applications and systems running pypdf by version-check production, staging, and development environments. Within 7 days: Upgrade to pypdf 6.14.1 and test in staging environments before production rollout. Within 30 days: Complete production deployment of pypdf 6.14.1 and verify all applications are running the patched version.

pypdf CVE-2026-59936

Q: What is the CVSS score of CVE-2026-59936?

CVE-2026-59936 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42366 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-08 GitHub_M

GHSA-5xf7-4p34-54qr

Denial Of Service Python Red Hat Pypdf Suse Py Pdf

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

A crafted PDF reaches the parser with no auth or interaction (AV:N/PR:N/UI:N/AC:L); impact is an infinite-loop hang, so A:H only with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:27 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on pypdf (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.14.1.

DescriptionCVE.org

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 2 Critical, 8 High, 1 With POC Jul 09, 2026

AnalysisAI

Denial of service in the pypdf Python PDF library (all versions prior to 6.14.1) allows a remote attacker to hang a consuming application by supplying a malicious PDF. A page content stream containing an unterminated inline image drives the inline-image end-marker detection logic into an infinite loop, most notably triggered during page text extraction. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects an unauthenticated, low-complexity availability attack, and a fixed release (6.14.1) is available.

Technical ContextAI

pypdf is a widely used pure-Python library for reading, splitting, merging, and extracting content from PDF documents. The flaw lives in the parser that handles PDF inline images - small images embedded directly inside a page content stream between the 'BI' (Begin Image) and 'EI' (End Image) operators. The loop that scans forward looking for the 'EI' end marker fails to terminate when the marker is absent, matching CWE-400 (Uncontrolled Resource Consumption): the routine never reaches a stopping condition and spins indefinitely, consuming CPU. Because text extraction walks the content stream, any workflow that calls extract_text() (or similar operations that parse page content) on the crafted document triggers the hang. The affected package is identified by CPE cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:* covering all builds before the patch.

RemediationAI

Upgrade to pypdf 6.14.1 or later, which fixes the inline-image end-marker loop (Vendor-released patch: 6.14.1; e.g. 'pip install --upgrade pypdf>=6.14.1'). The fix is confirmed by GitHub advisory GHSA-5xf7-4p34-54qr (https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr), PR https://github.com/py-pdf/pypdf/pull/3891, commit ec3b14596186c40caca7cf8ab9b2155203e01b5b, and the 6.14.1 release notes (https://github.com/py-pdf/pypdf/releases/tag/6.14.1). Where immediate upgrading is not possible, apply compensating controls around untrusted PDF handling: run the parsing/text-extraction step in a separate worker process with a hard wall-clock timeout and CPU limit so a hung parse can be killed (trade-off: added complexity and per-document overhead), cap the size of accepted PDFs and rate-limit uploads to blunt amplification, and where feasible avoid or defer full-content text extraction on untrusted files until after upgrade. These controls bound impact but do not eliminate the underlying infinite loop, so patching remains the real fix.