{"id":"CVE-2026-59935","title":"pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image (CVE-2026-59935)","summary":"A flaw was found in pypdf, a pure-python PDF library. A remote attacker can craft a malicious PDF file containing an unterminated inline image within the page content stream. When this crafted PDF is parsed, it can lead to an infinite loop…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-606","CWE-835"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["exploit_intelligence","openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","quay 3"],"patched":["pypdf 6.14.2"],"published":"2026-07-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:20:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59935.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59935.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59935"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498214"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59935"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59935"},{"url":"https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2"},{"url":"https://github.com/py-pdf/pypdf/pull/3892"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.2"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q"},{"url":"https://github.com/py-pdf/pypdf"},{"url":"https://github.com/advisories/GHSA-g867-7843-wf8q"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.0062,"epssPercentile":0.49484,"aliases":["GHSA-g867-7843-wf8q","PYSEC-2026-3613"],"ecosystem":"pip","ingestedAt":"2026-07-23T17:18:58.493Z","slug":"CVE-2026-59935","body":"## Overview\n\nA flaw was found in pypdf, a pure-python PDF library. A remote attacker can craft a malicious PDF file containing an unterminated inline image within the page content stream. When this crafted PDF is parsed, it can lead to an infinite loop, resulting in a denial of service (DoS) due to resource exhaustion.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Quay 3 · no fix planned: Exploit Intelligence, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59935.json)\n\n**pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image** — rated Moderate by Red Hat. Released 2026-07-08, updated 2026-10-15.\n\nAffected:\n\n- Exploit Intelligence\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n\nNo fix planned:\n\n- Exploit Intelligence\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-59935)\n\nAffected packages:\n\n- `pypdf < 6.14.2`\n\nPatched in:\n\n- `pypdf 6.14.2`\n\nSource: https://osv.dev/vulnerability/GHSA-g867-7843-wf8q","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222219,"id":"CVE-2026-59935","ts":1792065086642,"field":"cvss","old":null,"new":"6.5"},{"seq":222218,"id":"CVE-2026-59935","ts":1792065086642,"field":"severity","old":"high","new":"medium"}]}