Is CVE-2026-59935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59935 being exploited in the wild.

How severe is CVE-2026-59935?

High severity, with a CVSS score of 4, published 8 July 2026.

Which products and versions are affected?

pypdf (PyPI) < 6.14.2, ECOSYSTEM:introduced=0,fixed=6.14.2.

Is there a fix for CVE-2026-59935?

Yes. pypdf (PyPI): upgrade to 6.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59935 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59935?

Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59935: py-pdf pypdf infinite loop in inline image parsing

Q: Which products and versions are affected?

pypdf (PyPI) < 6.14.2, ECOSYSTEM:introduced=0,fixed=6.14.2.

Q: Is there a fix for CVE-2026-59935?

Yes. pypdf (PyPI): upgrade to 6.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59935 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59935?

Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59935 · Severity: high · CVSS 4 · Published 2026-07-08

A vulnerability in the pypdf library, a popular tool for manipulating PDF files, can allow an attacker to cause a denial-of-service condition. By providing a specially crafted PDF file, an attacker can trigger an infinite loop during file processing, such as when extracting text. This can lead to high CPU usage and cause applications or services using the library to become unresponsive.

Technologies: pypdf (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59935 being exploited in the wild.
How severe is CVE-2026-59935?: High severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?: pypdf (PyPI) < 6.14.2, ECOSYSTEM:introduced=0,fixed=6.14.2.
Is there a fix for CVE-2026-59935?: Yes. pypdf (PyPI): upgrade to 6.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59935 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59935?: Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pypdf (PyPI): upgrade to 6.14.2 or later
```
pip install "pypdf>=6.14.2"
```

Technical details

An infinite loop vulnerability (CWE-835) exists in pypdf due to improper handling of unterminated inline images. The issue is specifically triggered when parsing content streams that utilize ASCII85 or ASCIIHex filters. An attacker can exploit this by providing a crafted PDF; when the library attempts to parse the stream (e.g., during text extraction), it enters a loop with no exit condition. This results in a denial-of-service (DoS) by exhausting CPU resources. The vulnerability is fixed in version 6.14.2.

Affected products

py-pdf pypdf < 6.14.2

Identifiers

CVE-2026-59935
GHSA-g867-7843-wf8q
PYSEC-2026-3613

Timeline

2026-06-23: disclosed
2026-07-08: advisory: NVD publication date
2026-07-23: patched: GitHub Advisory published/reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.