Is there a patch available for CVE-2026-59937?

Yes, a patch is available for CVE-2026-59937. Update the affected software to the latest version immediately.

pypdf CVE-2026-59937

Q: What is the CVSS score of CVE-2026-59937?

CVE-2026-59937 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42344 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-08 GitHub_M

GHSA-55h5-xmcq-c37v

Denial Of Service Python Red Hat Pypdf Suse Py Pdf

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable via PDF submission, no privileges or interaction needed; availability impact is Low given 'long runtimes' rather than full crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 19:01 EUVD

Analysis Generated

Jul 08, 2026 - 17:51 vuln.today

DescriptionCVE.org

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

AnalysisAI

Uncontrolled resource consumption in pypdf prior to 6.14.0 allows unauthenticated remote attackers to cause denial of service by submitting a crafted PDF containing repeated malformed cross-reference streams. The library's XRef table recovery routine performs unbounded work on such inputs, leading to excessive CPU time consumption and effectively hanging or severely degrading any application that processes attacker-supplied PDFs. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

pypdf (CPE: cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*) is a pure-Python library for reading, writing, and manipulating PDF files. PDF files use cross-reference (XRef) tables or streams to index object locations within the file. When a PDF contains malformed or broken XRef streams, pypdf enters a recovery code path intended to reconstruct the object index. The root cause (CWE-400: Uncontrolled Resource Consumption) lies in this recovery routine failing to bound the number of iterations or time spent when processing repeated malformed XRef stream entries, allowing a crafted PDF to drive the parser into a near-infinite repair loop. The fix landed in commit b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae via PR #3887 and was released in 6.14.0.

RemediationAI

Upgrade pypdf to version 6.14.0 or later, which resolves this issue via the fix in commit b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae (PR #3887). The patched release is available at https://github.com/py-pdf/pypdf/releases/tag/6.14.0 and can be installed via pip using 'pip install pypdf>=6.14.0'. If immediate upgrade is not possible, compensating controls include enforcing strict per-request processing timeouts before invoking pypdf on untrusted input, running PDF parsing in isolated worker processes with wall-clock time limits and SIGALRM or concurrent.futures timeouts, and pre-screening uploaded PDFs with structural size limits on XRef stream counts. These workarounds add operational complexity and may reject some legitimate malformed-but-benign PDFs, but they reduce exposure until patching is complete.