CVE-2026-59935
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The pypdf library prior to version 6.14.2 is vulnerable to a DoS attack due to an infinite loop when parsing PDF files. An attacker can craft a malicious PDF with a not terminated inline image using ASCII85 or ASCIIHex filters, causing the process to hang.
Risk Assessment
The risk is a Denial of Service (DoS) attack on applications using pypdf to process PDF files. An attacker can send a malicious PDF document that will block the service or application.
Recommendation
Immediately update the pypdf library to version 6.14.2 or later. If an update is not possible, implement PDF file validation before processing with pypdf.
Other vulnerabilities in pypdf
See all- CVE-2026-71870Medium
pypdf prior to 6.15.0 is vulnerable to excessive memory consumption when parsing crafted PDFs, as the parse_bfrange function in pypdf/_cmap.py handles unusually large tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in version 6.15.0.
- CVE-2026-71852Medium
A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.
- CVE-2026-59936High
In pypdf library prior to version 6.14.1, a vulnerability was found causing an infinite loop when processing inline images in PDF page content streams. An attacker can craft a malicious PDF with a not terminated inline image, leading to a hang during text extraction.
- CVE-2026-59938Medium
In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with declared image size values much larger than the actual data, causing excessive memory usage during image parsing. This can be exploited for a denial-of-service (DoS) attack by exhausting memory resources.
- CVE-2026-59937High
In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with multiple malformed cross-reference streams, causing long runtimes for recovering broken cross-reference table entries. This leads to excessive CPU usage and processing delays.
- CVE-2026-57204Medium
The pypdf library before version 6.13.3 contains a DoS vulnerability. A specially crafted PDF can cause excessive memory usage because the MAX_DECLARED_STREAM_LENGTH constant is sometimes ignored when parsing a content stream without a /Length value.
- CVE-2026-54651Medium
pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.1, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop.
- CVE-2026-54531Medium
pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.0, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop.
- CVE-2026-54530Medium
pypdf is a free and open-source pure-python PDF library. Prior to version 6.13.0, an attacker could exploit this vulnerability to craft a PDF that leads to an infinite loop when extracting text in layout mode.
- CVE-2026-49461Medium
pypdf is a free and open-source pure-python PDF library. Prior to version 6.12.2, an attacker could craft a PDF that leads to large memory usage by extracting text from a page containing a form XObject with self-references.
Original NVD description (English source)
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.