CVE-2026-84310

Received Received - Intake

Denial of Service in pypdf via Unlimited Outline Nesting

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84310

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.16.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
CWE-834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

Executive Summary

This vulnerability in pypdf versions before 6.16.1 allows an attacker to create a malicious PDF that causes excessive CPU and memory usage when processing document outlines. The issue occurs because the code lacks limits on the number of entries or nesting depth during outline traversal.

Detection Guidance

The vulnerability in pypdf versions prior to 6.16.1 can be detected by checking the installed version of pypdf. Run 'pip show pypdf' or 'pip list | grep pypdf' to verify if the version is below 6.16.1. If your system uses pypdf in a PDF processing application, test with a crafted PDF containing large or deeply nested outlines to observe excessive memory or runtime usage.

No specific network detection commands are provided, but monitoring for unusual resource consumption during PDF processing may indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to slow down or crash systems processing PDFs by sending specially crafted files. This may lead to denial-of-service conditions, disrupting normal operations for users or services relying on pypdf.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through resource exhaustion. Excessive memory or CPU usage from processing malicious PDFs may disrupt system availability, which is a concern for both GDPR's availability principle and HIPAA's requirement for timely access to protected health information.

Mitigation Strategies

Immediately update pypdf to version 6.16.1 or later using 'pip install --upgrade pypdf'. If upgrading is not possible, restrict access to PDF processing functions or implement input validation to limit outline size and nesting depth. Review any applications using pypdf for potential exposure.

Hi! I’m here to help you understand CVE-2026-84310. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70