# CVE-2026-59935: py-pdf pypdf infinite loop in inline image parsing

Source: https://junglewise.ai/threats/cve-2026-59935-py-pdf-pypdf-infinite-loop-in-inline-image-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-59935 · Severity: high · CVSS 4 · Published 2026-07-08

A vulnerability in the pypdf library, a popular tool for manipulating PDF files, can allow an attacker to cause a denial-of-service condition. By providing a specially crafted PDF file, an attacker can trigger an infinite loop during file processing, such as when extracting text. This can lead to high CPU usage and cause applications or services using the library to become unresponsive.

Technologies: [pypdf (PyPI)](https://junglewise.ai/threats/technologies/pypdf). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59935 being exploited in the wild.

**How severe is CVE-2026-59935?** High severity, with a CVSS score of 4, published 8 July 2026.

**Which products and versions are affected?** pypdf (PyPI) < 6.14.2, ECOSYSTEM:introduced=0,fixed=6.14.2.

**Is there a fix for CVE-2026-59935?** Yes. pypdf (PyPI): upgrade to 6.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59935 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59935?** Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pypdf (PyPI): upgrade to 6.14.2 or later

  ```sh
  pip install "pypdf>=6.14.2"
  ```


## Technical details

An infinite loop vulnerability (CWE-835) exists in pypdf due to improper handling of unterminated inline images. The issue is specifically triggered when parsing content streams that utilize ASCII85 or ASCIIHex filters. An attacker can exploit this by providing a crafted PDF; when the library attempts to parse the stream (e.g., during text extraction), it enters a loop with no exit condition. This results in a denial-of-service (DoS) by exhausting CPU resources. The vulnerability is fixed in version 6.14.2.

## Affected products

- py-pdf pypdf < 6.14.2

## Identifiers

- CVE-2026-59935
- GHSA-g867-7843-wf8q
- PYSEC-2026-3613

## Timeline

- 2026-06-23: disclosed
- 2026-07-08: advisory: NVD publication date
- 2026-07-23: patched: GitHub Advisory published/reviewed

## References

- [https://api.github.com/users/koltiradw](https://api.github.com/users/koltiradw)
- [https://github.com/koltiradw](https://github.com/koltiradw)
- [https://api.github.com/users/koltiradw/gists%7B/gist_id%7D](https://api.github.com/users/koltiradw/gists%7B/gist_id%7D)
- [https://api.github.com/users/koltiradw/repos](https://api.github.com/users/koltiradw/repos)
- [https://avatars.githubusercontent.com/u/44571881?v=4](https://avatars.githubusercontent.com/u/44571881?v=4)
- [https://api.github.com/users/koltiradw/events%7B/privacy%7D](https://api.github.com/users/koltiradw/events%7B/privacy%7D)

## Related threats

- [pypdf memory exhaustion in cross-reference stream parsing](https://junglewise.ai/threats/cve-2026-119209-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf denial of service via forged encrypted PDF page count](https://junglewise.ai/threats/cve-2026-119208-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf excessive memory consumption in strict mode PDF parsing](https://junglewise.ai/threats/cve-2026-119207-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf denial of service via crafted page labels](https://junglewise.ai/threats/cve-2026-119206-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)
- [pypdf infinite loop in DictionaryObject cloning](https://junglewise.ai/threats/cve-2026-119205-pypdf-is-a-free-and-open-source-pure-python-pdf-library-prior-to)