~ / search / GHSA-5xf7-4p34-54qr

GHSA-5xf7-4p34-54qr

pypdf: Possible infinite loop for not terminated inline images

Source: GitHub Advisory Database (reviewed) High CVE-2026-59936

Packages

EcosystemPackageAffectedFixed in
PyPI pypdf < 6.14.1 6.14.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. ### Patches This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891).

References

External links from the advisory. They lead to third-party sites.