CVE-2026-84310 in pypdf
Summary
by MITRE • 09/02/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in pypdf versions prior to 6.16.1 represents a significant resource exhaustion risk stemming from insufficient input validation during the parsing of PDF document outlines. As an open-source Python library designed for manipulating PDF files, pypdf is frequently utilized by applications that process untrusted or semi-trusted documents. The core flaw resides within the _get_outline function located in the pypdf/_doc_common.py module. This component is responsible for traversing and retrieving the hierarchical structure of a document's outline, commonly known as bookmarks. In vulnerable versions, this traversal mechanism lacks critical safeguards such as global entry-count limits or nesting-depth constraints. Consequently, an attacker can craft a malicious PDF file containing either an excessively large number of outline entries or deeply nested structures that reference reused paths in a recursive manner. When the library processes such a document, it enters into prolonged execution loops and consumes disproportionate amounts of system memory without any mechanism to abort or limit the operation based on complexity metrics.
From a technical perspective, this vulnerability is classified under CWE-787: Out-of-bounds Write if interpreted through resource allocation failures leading to crashes, but more accurately aligns with CWE-400: Uncontrolled Resource Consumption and specifically CWE-1325: Improperly Controlled Sequential Memory Allocation. The absence of depth limits allows for potential stack overflow scenarios or heap exhaustion depending on the internal implementation details of Python's recursion handling and memory management during object instantiation. This lack of bounds checking enables a denial-of-service condition where legitimate services relying on pypdf can be rendered unavailable due to resource saturation. In enterprise environments, this could lead to service degradation across multiple applications if they share underlying system resources or operate within constrained containerized environments with limited memory quotas.
The operational impact extends beyond simple application crashes. If the vulnerable library is integrated into web-based document processing pipelines, an attacker can trigger these conditions remotely by uploading a crafted PDF through any interface that accepts file uploads and subsequently processes them using pypdf. This creates a vector for automated denial-of-service attacks against cloud infrastructure or on-premise servers hosting document management systems. The prolonged runtime also increases the attack surface for timing-based side-channel attacks, although the primary concern remains resource exhaustion. Mitigation strategies must prioritize immediate upgrading to version 6.16.1 or later, where developers have implemented necessary limits on outline traversal depth and entry counts. For organizations unable to upgrade immediately, implementing a sandboxed execution environment with strict memory and CPU time quotas for PDF processing tasks can provide temporary protection against exploitation attempts by limiting the impact of resource exhaustion attacks.