High
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Type: advisorySources: OSV
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59935
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 21:17 UTC · Revision 1
Source evidence
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
core-osv · Original sourcePublished 8 Jul 2026, 19:34 UTC
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
osv:CVE-2026-59935
Complete source record
{
"id": "58a188d58d27815e442cb777059e528969b0ea4f1d32690ccc02c752fa79946c",
"url": "https://osv.dev/vulnerability/CVE-2026-59935",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)",
"summary": "pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.",
"evidence": "osv:CVE-2026-59935",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-59935",
"aliases": [
"CVE-2026-59935",
"GHSA-g867-7843-wf8q",
"PYSEC-2026-3613"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/py-pdf/pypdf",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2266ee853d1420c8774f6657ce3b8f1502cac713"
},
{
"fixed": "5a33a46416aa1ae6c025ff90a3cca57631fdafd2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.14.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "5a33a46416aa1ae6c025ff90a3cca57631fdafd2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "2266ee853d1420c8774f6657ce3b8f1502cac713"
}
],
"source": "REFERENCES_TAG",
"original_tag": "6.14.2"
}
]
}
}
],
"versions": [
"6.14.1",
"6.14.0",
"6.13.3",
"6.13.2",
"6.13.1",
"6.13.0",
"6.12.2",
"6.12.1",
"6.12.0",
"6.11.0",
"6.10.2",
"6.10.1",
"6.10.0",
"6.9.2",
"6.9.1",
"6.9.0",
"6.8.0",
"6.7.5",
"6.7.4",
"6.7.3",
"6.7.2",
"6.7.1",
"6.7.0",
"6.6.2",
"6.6.1",
"6.6.0",
"6.5.0",
"6.4.2",
"6.4.1",
"6.4.0",
"6.3.0",
"6.2.0",
"6.1.3",
"6.1.2",
"6.1.1",
"6.1.0",
"6.0.0",
"5.9.0",
"5.8.0",
"5.7.0",
"5.6.1",
"5.6.0",
"5.5.0",
"5.4.0",
"5.3.1",
"5.3.0",
"5.2.0",
"5.1.0",
"5.0.1",
"5.0.0",
"4.3.1",
"4.3.0",
"4.2.0",
"4.1.0",
"4.0.2",
"4.0.1",
"4.0.0",
"3.17.4",
"3.17.3",
"3.17.2",
"3.17.1",
"3.17.0",
"3.16.4",
"3.16.3",
"3.16.2",
"3.16.1",
"3.16.0",
"3.15.5",
"3.15.4",
"3.15.3",
"3.15.2",
"3.15.1",
"3.15.0",
"3.14.0",
"3.13.0",
"3.12.2",
"3.12.1",
"3.12.0",
"3.11.1",
"3.11.0",
"3.10.0",
"3.9.1",
"3.9.0",
"3.8.1",
"3.8.0",
"3.7.1",
"3.7.0",
"3.6.0",
"3.5.2",
"3.5.1",
"3.5.0",
"3.4.1",
"3.4.0",
"3.3.0",
"3.2.1",
"3.2.0",
"3.0.0",
"3.1.0",
"2.12.1",
"2.12.0",
"2.11.2",
"2.11.1",
"2.11.0",
"2.10.9",
"2.10.8",
"2.10.7",
"2.10.6",
"2.10.5",
"2.10.4",
"2.10.3",
"2.10.2",
"2.10.1",
"2.10.0",
"2.9.0",
"2.8.1",
"2.8.0",
"2.7.0",
"2.6.0",
"2.5.0",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.1",
"2.3.0",
"2.2.1",
"2.2.0",
"2.1.1",
"2.1.0",
"2.0.0",
"1.28.2",
"1.28.1",
"1.28.0",
"1.27.12",
"1.27.11",
"1.27.10",
"1.27.9",
"1.27.8",
"1.27.7",
"1.27.6",
"1.27.5",
"1.27.4",
"1.27.3",
"1.27.2",
"1.27.1",
"1.27.0",
"v1.24",
"1.26.0",
"v1.25.1",
"v1.25",
"v1.23",
"v1.22",
"v1.21",
"v1.20",
"v1.19",
"v1.18",
"v1.17"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59935.json"
}
}
],
"modified": "2026-10-28T02:30:23.532041300Z",
"provider": "osv",
"references": [
"https://github.com/py-pdf/pypdf/releases/tag/6.14.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59935.json",
"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59935",
"https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2",
"https://github.com/py-pdf/pypdf/pull/3892"
],
"provider_metadata": {
"cwe_ids": [
"CWE-835"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59935.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59935",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490167,
"published_at": "2026-07-08T19:34:15.078+00:00"
}