CVE-2026-59936
published 2026-07-08CVE-2026-59936: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.62%
49.0th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.14.1 | 6.14.1 |
| pypdf_project | pypdf | < 6.14.1 | 6.14.1 |
| pypdf_project | pypdf | >= 0 < 6.14.1 | 6.14.1 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Possible infinite loop for not terminated inline images
ghsa·2026-07-23
CVE-2026-59936 [HIGH] CWE-400 pypdf: Possible infinite loop for not terminated inline images
pypdf: Possible infinite loop for not terminated inline images
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
### Patches
This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891).
Red Hat
pypdf: pypdf: Denial of Service via crafted PDF inline image
vendor_redhat·2026-07-08·CVSS 7.5
CVE-2026-59936 [HIGH] CWE-835 pypdf: pypdf: Denial of Service via crafted PDF inline image
pypdf: pypdf: Denial of Service via crafted PDF inline image
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
A flaw was found in pypdf, a pure-Python PDF library. A remote attacker can craft a malicious PDF document containing an unterminated inline image within its page content stream. When a user processes this crafted PDF, such as during text extraction, the vulnerability causes an infinite loop, leading to a Denial of Service (DoS) condition. This issue impacts the availability of the pypdf application.
Statement: This Moder
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59936 python-pypdf: pypdf: Denial of Service via crafted PDF inline image [fedora-all]
bugzilla·2026-07-09·CVSS 7.5
CVE-2026-59936 [HIGH] CVE-2026-59936 python-pypdf: pypdf: Denial of Service via crafted PDF inline image [fedora-all]
CVE-2026-59936 python-pypdf: pypdf: Denial of Service via crafted PDF inline image [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
Discussion:
Version 6.14.2 is now in rawhide.
For Fedora 44/43, I'm reluctant to upgrade them since it would be upgrading 2 major versions (from 4.2.0 to 6.14.2) in
Bugzilla
CVE-2026-59936 pypdf: pypdf: Denial of Service via crafted PDF inline image
bugzilla·2026-07-08·CVSS 7.5
CVE-2026-59936 [HIGH] CVE-2026-59936 pypdf: pypdf: Denial of Service via crafted PDF inline image
CVE-2026-59936 pypdf: pypdf: Denial of Service via crafted PDF inline image
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.
2026-07-08
Published