p PatchFirst

CVE-2026-59935

CVE-2026-59935 · pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pypdf

    Versions
    • < 6.14.2: Affected

    No fix published

  • pypdf Debian:12

    Versions
    • 3.17.4-1
    • 3.4.1-1
    • 3.4.1-1+deb12u1
    • 4.0.0-1
    • 4.0.0-1~exp1
    • 4.0.1-1
    • 4.0.2-1
    • 4.1.0-1
    • 4.2.0-1
    • 4.3.1-1
    • 5.4.0-1
    • 6.19.0-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:13

    Versions
    • 5.4.0-1
    • 6.19.0-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Debian:14

    Versions
    • 5.4.0-1
    • 6.9.0-1
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: < 6.19.0-1

    Update to 6.19.0-1

  • pypdf2 Debian:12

    Versions
    • 2.12.1-3
    • 2.12.1-3+deb12u1
    • 2.12.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf PyPI

    Versions
    • 1.0
    • 1.1
    • 1.10
    • 1.11
    • 1.12
    • 1.13
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.8
    • 1.9
    • 3.1.0
    • 3.10.0
    • 3.11.0
    • 3.11.1
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.14.0
    • 3.15.0
    • 3.15.1
    • 3.15.2
    • 3.15.3
    • 3.15.4
    • 3.15.5
    • 3.16.0
    • 3.16.1
    • 3.16.2
    • 3.16.3
    • 3.16.4
    • 3.17.0
    • 3.17.1
    • 3.17.2
    • 3.17.3
    • 3.17.4
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.4.0
    • 3.4.1
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.7.0
    • 3.7.1
    • 3.8.0
    • 3.8.1
    • 3.9.0
    • 3.9.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.5.0
    • 5.6.0
    • 5.6.1
    • 5.7.0
    • 5.8.0
    • 5.9.0
    • 6.0.0
    • 6.1.0
    • 6.1.1
    • 6.1.2
    • 6.1.3
    • 6.10.0
    • 6.10.1
    • 6.10.2
    • 6.11.0
    • 6.12.0
    • 6.12.1
    • 6.12.2
    • 6.13.0
    • 6.13.1
    • 6.13.2
    • 6.13.3
    • 6.14.0
    • 6.14.1
    • 6.2.0
    • 6.3.0
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.6.2
    • 6.7.0
    • 6.7.1
    • 6.7.2
    • 6.7.3
    • 6.7.4
    • 6.7.5
    • 6.8.0
    • 6.9.0
    • 6.9.1
    • 6.9.2
    Affected ranges
    • ECOSYSTEM: < 6.14.2

    Update to 6.14.2

  • pypdf2 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.23+git20141008-1
    • 1.25.1-1
    • 1.25.1-1ubuntu0.1~esm1
    • 1.25.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.26.0-2
    • 1.26.0-2ubuntu0.1~esm1
    • 1.26.0-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:20.04:LTS

    Versions
    • 1.26.0-2
    • 1.26.0-3ubuntu1
    • 1.26.0-3ubuntu1.20.04.1
    • 1.26.0-3ubuntu1.20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:22.04:LTS

    Versions
    • 1.26.0-4
    • 1.26.0-4ubuntu0.22.04.1
    • 1.26.0-4ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:24.04:LTS

    Versions
    • 3.4.1-1
    • 3.17.4-1
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf2 Ubuntu:24.04:LTS

    Versions
    • 2.12.1-3
    • 2.12.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:25.10

    Versions
    • 4.3.1-1
    • 5.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.10

    Versions
    • 6.9.2-1
    • 6.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypdf Ubuntu:26.04:LTS

    Versions
    • 5.4.0-1
    • 6.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →