DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59935: CVE-2026-59935: Infinite Loop Denial of Service in pypdf via Malformed Inline Images

#security #cve #cybersecurity

CVE-2026-59935: Infinite Loop Denial of Service in pypdf via Malformed Inline Images

Vulnerability ID: CVE-2026-59935
CVSS Score: 8.7
Published: 2026-07-23

An infinite loop vulnerability exists in the pypdf library prior to version 6.14.2 when processing malformed PDF inline images that utilize ASCII85 or ASCIIHex decoders. Attackers can exploit this vulnerability by submitting crafted PDF files containing incomplete streams, causing the parsing thread to consume 100% CPU resource indefinitely and leading to Denial of Service.

TL;DR

A denial-of-service vulnerability in the pypdf library prior to version 6.14.2 allows remote attackers to trigger 100% CPU exhaustion. By uploading a crafted PDF containing a non-terminated inline image using ASCII85 or ASCIIHex filters, the library enters an infinite loop during parsing operations.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-835
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.7
  • EPSS Score: 0.00352 (0.352%)
  • Impact: Denial of Service (Availability)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not Listed

Affected Systems

  • Web applications processing untrusted user-submitted PDF files
  • Data ingestion pipelines utilizing pypdf for text and image extraction
  • Microservices running vulnerable versions of pypdf (< 6.14.2)
  • pypdf: < 6.14.2 (Fixed in: 6.14.2)

Code Analysis

Commit: 5a33a46

Fix infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Mitigation Strategies

  • Upgrade the pypdf library to version 6.14.2 or higher to resolve the infinite loop flaw.
  • Isolate PDF processing workloads into containerized worker pools with strict execution timeout policies.
  • Deploy monitoring solutions to detect anomalous CPU spikes on nodes processing external file uploads.

Remediation Steps:

  1. Identify all internal services and dependencies referencing the pypdf package.
  2. Execute the package manager update command: pip install --upgrade pypdf>=6.14.2
  3. Verify that the updated packages are integrated into production build pipelines and deployment templates.
  4. Implement worker processing timeouts at the application layer to enforce safe process terminations.

References

Read the full report for CVE-2026-59935 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)