PyPI/pypdf CVE-2026-59937: medium, EPSS 0.62%

pypdf: Possible long runtimes for repeated malformed cross-reference entries

Action: Upgrade pypdf to 6.14.0 or later.

pip install pypdf==6.14.0

Affected

Fixed versions

Sources

• osv: GHSA-55h5-xmcq-c37v
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v
• https://nvd.nist.gov/vuln/detail/CVE-2026-59937
• https://github.com/py-pdf/pypdf/pull/3887
• https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.14.0

CVE-2026-59937 · published 2026-07-23T15:07:33Z · modified 2026-09-10T03:50:12.272620075Z · JSON