CVE-2026-59937: CPU Exhaustion via Quadratic-Time Cross-Reference Recovery Loop in pypdf
Vulnerability ID: CVE-2026-59937
CVSS Score: 7.5
Published: 2026-07-23
A critical CPU exhaustion vulnerability exists in the pypdf library before version 6.14.0. When parsing PDF files with malformed or corrupt standard cross-reference (xref) table entries, the library falls back to sequentially scanning the entire file buffer via regular expression search. An attacker can exploit this algorithmic bottleneck by supplying a crafted PDF with numerous malformed xref entries, leading to denial of service.
TL;DR
pypdf versions prior to 6.14.0 are vulnerable to denial of service (CPU exhaustion) when parsing crafted PDFs containing thousands of malformed xref table entries due to an O(N*M) sequential regex recovery loop.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network (AV:N)
- CVSS Score: 7.5 (High)
- EPSS Score: 0.00345 (0.345%)
- Impact: Denial of Service (DoS) via CPU Exhaustion
- Exploit Status: PoC (Proof of Concept) available
- KEV Status: Not listed
Affected Systems
- Applications parsing user-supplied PDF documents using pypdf versions < 6.14.0
- Automated Python-based document processing pipelines
-
pypdf: < 6.14.0 (Fixed in:
6.14.0)
Code Analysis
Commit: b5fc5aa
SEC: Speed up recovery when reading broken cross-reference table (#3887)
Exploit Details
- GitHub Security Advisory: No description
Mitigation Strategies
- Upgrade pypdf to 6.14.0 or later
- Enforce strict PDF file upload size limits
- Execute PDF parsing inside isolated worker pools with processing timeouts
Remediation Steps:
- Identify all environments utilizing pypdf
- Run 'pip install --upgrade pypdf>=6.14.0'
- Verify the upgraded package version using 'pip show pypdf'
- Redeploy the updated application to production environments
References
Read the full report for CVE-2026-59937 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)