Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-59935: pypdf can get stuck processing crafted PDFs
CVE-2026-59935 · published 3 months ago
Summary
The Python PDF library pypdf (and its variants) may enter an endless loop when it reads a specially formed PDF that contains an incomplete inline image using certain encoding methods. This can cause software that extracts text or processes PDFs to freeze. Update to version 6.14.2 or later to prevent the hang.
What to do
- Update rootio-pypdf to version 6.11.0+root.io.2.
- Update stefan6419846 pypdf to version 6.10.1+aikido.8.
- Update stefan6419846 pypdf to version 6.10.1+aikido.10.
- Update stefan6419846 pypdf to version 6.12.1+aikido.4.
- Update stefan6419846 pypdf to version 6.6.0+aikido.13.
- Update stefan6419846 pypdf to version 6.10.1+aikido.9.
- Update stefan6419846 pypdf to version 6.12.2+aikido.5.
- Update stefan6419846 pypdf to version 6.14.2.
- Update pypdf_project pypdf to version 6.14.2 or later.
- Update py-pdf pypdf to version 6.14.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | pypdf | All versions |
| Debian:13 | debian | pypdf | All versions |
| Debian:14 | debian | pypdf | All versions |
| Debian:11 | debian | pypdf2 | All versions |
| Debian:12 | debian | pypdf2 | All versions |
| – | py-pdf | pypdf | < 6.14.2 |
| – | pypdf_project | pypdf |
< 6.14.2 cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | pypdf2 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | pypdf2 | All versions |
| Ubuntu:20.04:LTS | canonical | pypdf2 | All versions |
| Ubuntu:22.04:LTS | canonical | pypdf2 | All versions |
| Ubuntu:24.04:LTS | canonical | pypdf | All versions |
| Ubuntu:24.04:LTS | canonical | pypdf2 | All versions |
| Ubuntu:25.10 | canonical | pypdf | All versions |
| Ubuntu:26.04:LTS | canonical | pypdf | All versions |
| Root:PyPI | – | rootio-pypdf |
< 6.11.0+root.io.2 Fix: upgrade to 6.11.0+root.io.2
|
| Root:PyPI | stefan6419846 | pypdf |
< 6.10.1+aikido.8 < 6.10.1+aikido.10 < 6.12.1+aikido.4 < 6.6.0+aikido.13 < 6.10.1+aikido.9 < 6.12.2+aikido.5 Fix: upgrade to 6.10.1+aikido.8
|
| pip | stefan6419846 | pypdf |
< 6.14.2 Fix: upgrade to 6.14.2
|
Original advisory text
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
References
- https://ubuntu.com/security/CVE-2026-59935 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59935 Third Party Advisory
- https://github.com/advisories/GHSA-g867-7843-wf8q
- https://nvd.nist.gov/vuln/detail/CVE-2026-59935 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-59935 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59935... Vendor Advisory
- https://github.com/py-pdf/pypdf/releases/tag/6.14.2 URL
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q Vendor Advisory
- https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 Patch
- https://github.com/py-pdf/pypdf/pull/3892 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published8 Jul 2026
Updated4 Nov 2026
First seen8 Jul 2026
Sources
UBUNTU-CVE-2026-59935 · OSV
CVE-2026-59935 · NVD
CVE-2026-59935 · MITRE
GHSA-g867-7843-wf8q · GHSA
DEBIAN-CVE-2026-59935 · OSV
CVE-2026-59935 · OSV
Track software like this
Free during beta