CVE-2026-59936: pypdf Infinite Loop Denial of Service Vulnerability (6.14.1)

Technical summary

CVE-2026-59936 is a denial-of-service vulnerability in pypdf arising from improper handling of unterminated inline images (EI operator) in PDF content streams. When pypdf attempts to locate the end marker (EI) of an inline image, a crafted PDF containing a malformed or incomplete inline image definition causes the parser to enter an infinite loop. This occurs during text extraction or general page content processing. The root cause is insufficient validation of the inline image boundary, allowing an attacker to craft a PDF that never terminates the image data section. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), reflecting the algorithmic complexity and resource exhaustion nature of the flaw.

Business impact

Organizations relying on pypdf for automated PDF processing—such as document management systems, form extraction pipelines, compliance scanning tools, and content analysis workflows—face availability risk. A malicious PDF uploaded or supplied by an external party could hang or crash backend services without authentication or user interaction. This impacts service reliability and can disrupt business processes that depend on continuous PDF ingestion. For systems processing untrusted PDFs from the internet or open submissions, the risk is elevated.

Affected systems

pypdf versions prior to 6.14.1 are vulnerable. This includes all 6.x versions before 6.14.1, as well as earlier major versions. Any application or service using pypdf as a dependency is at risk if it processes PDFs from untrusted sources. This includes Python environments in web applications, data pipelines, document processing microservices, and libraries that wrap or embed pypdf.

Exploitability

This vulnerability requires only a crafted PDF file; there are no authentication barriers, network complexity, or user interaction required beyond the victim processing the malicious PDF. Distribution is trivial—the attacker simply needs the target application to open or parse the file. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and the direct availability impact, though confidentiality and integrity are unaffected. Exploitation does not require special system privileges or knowledge of the target environment.

Remediation

Upgrade pypdf to version 6.14.1 or later. Organizations should inventory all applications and services using pypdf as a dependency—including transitive dependencies—and apply the patch. For systems that cannot immediately upgrade, implement input validation by rejecting PDFs from untrusted sources or scanning incoming PDFs with external validation tools. Consider running PDF processing in isolated, resource-constrained containers to limit the blast radius of a denial-of-service event.

Patch guidance

Apply the pypdf 6.14.1 release or any later version. Update the library via your package manager (pip install --upgrade pypdf or equivalent). Verify the upgrade by checking the installed version and redeploying affected services. Test the patched version in a staging environment to confirm compatibility with your PDF workflows before rolling out to production. Check upstream dependencies—if your application imports pypdf indirectly, ensure the parent library or framework has been updated to use the patched version.

Detection guidance

Monitor for applications or services that hang or become unresponsive when processing certain PDF files. Log and inspect any PDFs that cause parsing timeouts or infinite loops. Use static analysis or dependency scanning tools (e.g., pip-audit, safety, Dependabot) to identify pypdf versions earlier than 6.14.1 in your codebase and dependencies. Implement application-level monitoring to detect when PDF processing threads or processes consume CPU indefinitely without completing. Track PDF source provenance—PDFs from untrusted or newly-introduced sources merit closer scrutiny if processing hangs occur.

Why prioritize this

Despite being unincorporated into the CISA KEV catalog, this vulnerability warrants near-term prioritization due to its HIGH CVSS score (7.5), ease of exploitation, and broad applicability to automated systems. pypdf is widely used in data pipelines, web platforms, and document processing stacks. The availability impact is direct and requires no user interaction, making it attractive to attackers targeting service disruption. Organizations should patch within 30 days, sooner for systems processing untrusted PDFs.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-exploitable denial-of-service vulnerability with no authentication requirement. The attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges are needed (PR:N), and user interaction is not required (UI:N). The scope is unchanged (S:U), and impact is limited to availability (A:H), with no compromise of confidentiality or integrity. This severity level is consistent with resource exhaustion flaws that disable service availability but do not leak data or enable further compromise.

Frequently asked questions