CVE-2026-59937: pypdf: Possible long runtimes for repeated malformed cross-reference entries
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.
Patches
This has been fixed in pypdf==6.14.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3887.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.14.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.14.0 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3887] referenced in the material to mitigate long runtimes caused by repeated malformed cross-reference streams.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59937?
CVE-2026-59937 has a risk rating of 25.
How do I fix CVE-2026-59937?
To fix CVE-2026-59937, upgrade to pypdf version 6.14.0 or later.
What issue does CVE-2026-59937 cause?
CVE-2026-59937 allows an attacker to create PDFs that cause long runtimes in pypdf due to repeated malformed cross-reference entries.
Which software is affected by CVE-2026-59937?
CVE-2026-59937 affects the pypdf library prior to version 6.14.0.
When was CVE-2026-59937 published?
CVE-2026-59937 was published on July 8, 2026.