CVE-2026-84309 in pypdf
Summary
by MITRE • 09/01/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the pypdf library prior to version 6.16.0 represents a significant availability risk stemming from improper input validation and lack of depth limiting when processing PDF document structures. As an open-source pure-Python library, pypdf is widely used for parsing, manipulating, and generating Portable Document Format files in various automated workflows, including content extraction, metadata analysis, and document assembly. The core issue resides within the generic data structures module, specifically affecting the TreeObject.insert_child method which handles the insertion of child nodes into PDF object trees such as page trees or outline hierarchies. These tree structures are fundamental to how PDF documents organize their internal elements, relying on linked lists via /Next and /Prev pointers to traverse between objects efficiently without requiring random access for every element.
The technical flaw arises when an attacker crafts a malicious PDF file containing a cyclic reference within its object tree structure. Under normal circumstances, the parser should detect cycles or enforce maximum depth limits to prevent infinite traversal. However, in versions prior to 6.16.0, if the writing code path triggers the insertion of a child node into such a malformed tree, the implementation follows the /Next links without sufficient boundary checks. This results in an infinite loop as the parser continuously traverses nodes that point back to previously visited objects. Because Python is single-threaded by default for most operations and this traversal occurs within the main execution flow during document processing or modification, the application becomes unresponsive indefinitely until manually terminated or resource limits are externally enforced.
From a security impact perspective, this vulnerability primarily affects availability rather than confidentiality or integrity in its direct manifestation. An attacker can exploit this flaw to cause a Denial of Service against any service that processes user-uploaded PDF files using pypdf before version 6.16.0. This is particularly critical for web applications, document management systems, email gateways, and automated content processing pipelines where incoming documents are parsed or modified on the server side. The infinite loop consumes CPU resources continuously, potentially leading to application crashes, thread exhaustion in multi-threaded servers, or degradation of service for other users sharing the same computational environment. While it does not directly allow remote code execution, its impact on system stability and resource consumption makes it a serious concern for operational continuity.
This vulnerability aligns with CWE-835, which describes looping issues that can lead to denial of service conditions due to infinite loops or excessive iterations. It also relates to CWE-20 regarding improper input validation where the application fails to adequately verify the structural integrity and depth limits of incoming data structures. In terms of attack patterns, this exploitation technique mirrors aspects found in ATT&CK T1496, Resource Hijacking, specifically through computational exhaustion via infinite loops triggered by crafted inputs. The lack of cycle detection or maximum recursion/iteration depth enforcement is a common oversight in parsers that assume well-formed input from trusted sources, failing to account for adversarial manipulation designed to trigger edge cases in data structure traversal logic.
The recommended mitigation strategy involves upgrading the pypdf library to version 6.16.0 or later, where this issue has been resolved through improved cycle detection mechanisms and stricter limits on tree traversal depth during write operations. For organizations unable to immediately upgrade their dependencies due to compatibility constraints, implementing external safeguards is essential. These include deploying input validation layers that reject PDFs with suspiciously deep object trees before they reach the pypdf processing pipeline, configuring application-level timeouts or resource quotas to limit CPU time per request, and utilizing sandboxed execution environments such as containers or virtual machines with strict CPU limits to contain potential denial-of-service impacts. Additionally, integrating static analysis tools into the development lifecycle can help identify similar patterns in custom PDF handling code that may lack adequate depth limiting for linked list traversals.