VDB
CVE-2026-59935
CVE-2026-59935
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published July 8, 2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| py-pdf | pypdf | < 6.14.2 |
| chainguard | open-webui | 0 |
| py-pdf | pypdf | < 6.14.2, < 6.14.2 |
| chainguard | litellm | 0, 0, 0 |
| wolfi | open-webui | 0, 0, 0 |
Timeline
- Jul 8, 2026 CVE Published
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
- Jul 9, 2026 CVE Updated
- Jul 10, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q x_refsource_CONFIRM
- https://github.com/py-pdf/pypdf/pull/3892 x_refsource_MISC
- https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2 x_refsource_MISC
- https://github.com/py-pdf/pypdf/releases/tag/6.14.2 x_refsource_MISC