Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T19:34:15 pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-606

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can craft a malicious PDF file containing an unterminated inline image within the page content stream. When this crafted PDF is parsed, it can lead to an infinite loop, resulting in a denial of service (DoS) due to resource exhaustion.

This Moderate flaw in the pypdf library allows a remote attacker to trigger a denial of service by providing a specially crafted PDF file. The vulnerability arises from an infinite loop during parsing of an unterminated inline image, which can exhaust system resources. While requiring user interaction to process a malicious PDF, the issue can lead to service unavailability in applications utilizing pypdf for PDF processing. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Under investigation exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llama-stack-core-rhel9 Red Hat Quay 3 Under investigation quay/quay-rhel8 Red Hat Quay 3 Under investigation quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59935 https://nvd.nist.gov/vuln/detail/CVE-2026-59935 https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 https://github.com/py-pdf/pypdf/pull/3892 https://github.com/py-pdf/pypdf/releases/tag/6.14.2 https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q