pypdf is a pure‑Python PDF library that contains a logic flaw which causes an infinite loop when parsing a page content stream that includes a not terminated inline image using the ASCII85 or ASCIIHex filters, as the loop never terminates. This flaw represents a CWE‑606 input validation weakness and a CWE‑835 infinite‑loop flaw, exposing the application to denial‑of‑service attacks.

The pypdf package, published by py-pdf, is vulnerable in all releases older than 6.14.2. Any Python application that imports pypdf or processes PDFs using this library, such as web services or local tools, must upgrade to 6.14.2 or later.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS indicates an exploitation probability of less than 1 %. The likely attack vector is via malicious PDF inputs that an application processes, either locally or in a shared service. If an attacker can supply such PDFs, the infinite loop can be repeatedly triggered to consume resources, leading to service disruption or denial‑of‑service.