CVE-2026-59935: pypdf Infinite Loop Denial of Service in PDF Parsing

Technical summary

CVE-2026-59935 is an infinite loop vulnerability in pypdf's inline image parsing logic. The flaw exists in how the library handles unterminated inline image objects (IDstream) that declare ASCII85 or ASCIIHex encoding. During the decoding process, pypdf fails to detect the malformed termination sequence and continues looping indefinitely. The root cause maps to CWE-835 (Loop with Unreachable Exit Condition), a classic resource exhaustion pattern. Exploitation requires no authentication or user interaction beyond opening or processing the malicious PDF.

Business impact

Organizations relying on pypdf for automated PDF processing face service disruption risk. Batch operations—such as text extraction, indexing, or format conversion—will hang when encountering a malicious PDF, consuming CPU and blocking worker threads. This can cascade into application timeouts, failed jobs, and degraded availability. The impact is particularly acute in document management systems, data pipelines, or accessibility tools that process untrusted PDFs at scale. No data breach occurs, but availability damage is real and easily triggered.

Affected systems

pypdf versions prior to 6.14.2 are vulnerable. Any application or service that imports and uses pypdf to parse or extract content from PDF files is at risk. This includes web applications, command-line tools, automated document processors, and libraries that depend on pypdf as a transitive dependency. The vulnerability is platform-agnostic; Python runs on Windows, Linux, macOS, and cloud environments. Organizations should audit their dependency trees and software bills of materials (SBOMs) for pypdf usage.

Exploitability

Exploitation is straightforward and requires only a crafted PDF file. No special conditions, authentication, or complex techniques are necessary. An attacker can distribute the malicious PDF via email, upload it to a file-sharing service, or host it on a web server. The moment a vulnerable pypdf instance attempts to process it, the infinite loop is triggered. The barrier to exploitation is extremely low; this is a potent denial-of-service vector against any exposed PDF intake function.

Remediation

Upgrade pypdf to version 6.14.2 or later. This version contains fixes to properly detect and handle unterminated inline image objects, preventing the infinite loop. Organizations should prioritize this patch given the ease of exploitation and the high CVSS score of 7.5. In the interim, consider restricting PDF intake from untrusted sources or implementing strict timeout logic around pypdf calls to mitigate hang conditions.

Patch guidance

The fix is available in pypdf 6.14.2 and newer. Verify your current version by running `pip show pypdf` and compare against the upstream release notes. Update using `pip install --upgrade pypdf>=6.14.2`. For pinned or locked dependencies, update your requirements.txt, pyproject.toml, or similar manifest and rebuild your environment. No breaking changes are documented in the 6.14.2 release; the upgrade should be a drop-in replacement. Test in a non-production environment first to confirm compatibility with your specific use cases.

Detection guidance

Monitor PDF processing operations for unusual CPU spikes, thread hangs, or timeout exceptions. Review application logs for any signs of stuck pypdf parsing tasks. If you suspect an attack, enable verbose logging in pypdf (where available) or add instrumentation around the parsing calls to log the PDF structure or hash. Network-based detection is difficult since the malicious PDF could arrive via ordinary file transfer protocols. Prioritize endpoint monitoring and application-level alerting. Organizations with SIEM systems should correlate timeout events with PDF intake to surface potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention despite the absence of KEV listing. The combination of high CVSS (7.5), trivial exploitability, and broad exposure across PDF-heavy workflows creates significant risk. Denial-of-service attacks are often underestimated but can cripple document pipelines, automation systems, and customer-facing services. The fix is straightforward and available, making remediation low-friction. Organizations that process PDFs from external sources should treat this as a critical patch priority.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the attack vector (network, no authentication required), low complexity, and the guaranteed availability impact. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates that an unauthenticated attacker over the network can reliably cause a high-severity denial of service with no user interaction. The score does not account for business context (PDF processing is common), but the high rating appropriately signals that organizations running vulnerable pypdf instances face real operational risk.

Frequently asked questions