py-pdf pypdf up to 6.16.0 pypdf/_doc_common.py _get_outline resource consumption

Summaryinfo

A vulnerability classified as problematic has been found in py-pdf pypdf up to 6.16.0. This issue affects the function _get_outline of the file pypdf/_doc_common.py. The manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2026-84310. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in py-pdf pypdf up to 6.16.0. It has been rated as problematic. This issue affects the function _get_outline of the file pypdf/_doc_common.py. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-84310 since 09/01/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 6.16.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• py-pdf

Name

• pypdf

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16.0

Website

• Product: https://github.com/py-pdf/pypdf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion