Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T17:25:34 pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-1050

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

A flaw was found in pypdf, a pure-python PDF library. A remote attacker could exploit this vulnerability by crafting a malicious PDF file containing repeated malformed cross-reference streams. This could cause the pypdf library to spend excessive time recovering broken cross-reference table entries, leading to a denial of service (DoS) condition for applications processing such files.

This Moderate-impact denial of service flaw in the pypdf library affects applications processing untrusted PDF files. An attacker could exploit this by providing a specially crafted PDF with malformed cross-reference streams, causing significantly extended processing time. Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llama-stack-core-rhel9 Red Hat Quay 3 Fix deferred quay/quay-rhel8 Red Hat Quay 3 Fix deferred quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59937 https://nvd.nist.gov/vuln/detail/CVE-2026-59937 https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae https://github.com/py-pdf/pypdf/pull/3887 https://github.com/py-pdf/pypdf/releases/tag/6.14.0 https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v