CVE-2026-59937: pypdf Denial-of-Service via Malformed PDF Cross-Reference Streams

Technical summary

CVE-2026-59937 is a denial-of-service vulnerability stemming from improper handling of malformed cross-reference (xref) streams in PDF files. When pypdf encounters repeated xref stream anomalies, its error recovery mechanism enters a pathological state attempting to reconstruct broken entries, resulting in unbounded runtime. The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the library lacks adequate safeguards against algorithmic complexity attacks. The attack vector is network-based with low complexity; no special privileges or user interaction are required. The CVSS 3.1 score of 7.5 (HIGH) reflects high availability impact with no confidentiality or integrity compromise.

Business impact

Organizations and services using pypdf are at risk of service disruptions. Any automated PDF processing pipeline—invoice systems, document management, report generation, compliance workflows—can be halted by a single malicious PDF upload or attachment. This is particularly concerning for SaaS platforms, API services, and server-side PDF processing that handles untrusted user input. An attacker could exhaust CPU and memory on affected systems, causing cascading failures in dependent services. Cloud environments may incur unexpected resource costs due to sustained high utilization.

Affected systems

pypdf versions prior to 6.14.0 are vulnerable. This includes any application, service, or workflow that directly or indirectly depends on pypdf for PDF parsing or manipulation. The library is used in document management systems, data extraction tools, and PDF processing microservices. If your environment includes pypdf as a dependency (check requirements.txt, Pipfile, or pyproject.toml), you are potentially exposed.

Exploitability

Exploitability is straightforward. An attacker with the ability to introduce a crafted PDF into a system running vulnerable pypdf—via email attachment, web upload, API submission, or document sharing—can trigger the denial-of-service condition. No special tools, credentials, or reverse-engineering are needed; only a malicious PDF file. The vulnerability does not require social engineering if the PDF processing is automatic. This makes it a practical risk in any environment accepting PDF files from untrusted sources.

Remediation

Upgrade pypdf to version 6.14.0 or later. This patch addresses the malformed xref stream handling and implements resource consumption controls. Verify the upgrade by confirming the installed version using pip show pypdf. For applications unable to upgrade immediately, consider implementing PDF validation or sandboxing: reject PDFs exceeding size thresholds, process PDFs in isolated containers with resource limits (CPU/memory caps), or disable automatic PDF processing from untrusted sources pending patching.

Patch guidance

1. Identify all systems and applications using pypdf by reviewing dependency files and package management logs. 2. Test pypdf 6.14.0 in a non-production environment to ensure compatibility with your application. 3. Deploy the upgrade via your standard deployment pipeline, updating requirements.txt or equivalent to pin pypdf>=6.14.0. 4. Verify successful upgrade by running pip show pypdf and confirming version 6.14.0 or later. 5. Monitor error logs for any anomalies post-deployment. 6. Document the patch in your change management system and security incident log.

Detection guidance

Monitor for indicators of exploitation: sustained high CPU usage correlating with PDF processing events, application hangs or timeouts during PDF ingestion, memory usage spikes tied to document uploads, and repeated warnings or errors in pypdf logs related to cross-reference stream recovery. Implement logging on PDF file receipt (name, size, source) and correlate with performance degradation. Consider deploying file integrity monitoring on systems processing PDFs. In logs, look for patterns where a single PDF submission precedes system resource exhaustion. Network-level detection is limited since the malicious PDF is the payload itself; emphasis should be on endpoint and application-level visibility.

Why prioritize this

Although this vulnerability has a HIGH CVSS score and network accessibility, it is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating limited real-world exploitation evidence at publication. However, the ease of exploitation, broad applicability of pypdf, and direct impact on availability warrant prompt attention. Organizations processing PDFs from untrusted sources should prioritize patching within their standard update cadence (typically 1–4 weeks). Those accepting arbitrary PDF uploads should escalate to high priority and patch within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: network attack vector (AV:N) — no special access required; low attack complexity (AC:L) — no special conditions; no privilege requirement (PR:N); no user interaction needed (UI:N); availability impact is high (A:H) — services are degraded or unavailable. Confidentiality and integrity are unaffected (C:N, I:N), limiting the score. The HIGH severity is appropriate given the ease of exploitation and potential for service disruption, though the lack of data breach risk prevents a CRITICAL rating.

Frequently asked questions