CVE-2026-84311

Received Received - Intake

Memory Exhaustion in PyPDF via Recursive XObject Traversal

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84311

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.16.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

Executive Summary

This vulnerability in pypdf before version 6.16.1 allows an attacker to create a PDF file that causes excessive processing by tricking the library into traversing a complex graph of reused form objects. This leads to exponentially increasing runtime and memory usage, potentially causing the application to slow down or crash.

Detection Guidance

This vulnerability can be detected by checking the version of pypdf installed on your system. Run 'pip show pypdf' to see the installed version. If it is below 6.16.1, the system is vulnerable.

Impact Analysis

If you use pypdf in your application, an attacker could send a specially crafted PDF to consume excessive system resources, leading to degraded performance, crashes, or denial of service. This is especially risky for applications processing untrusted PDFs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a performance-related issue causing excessive resource consumption rather than a data breach or privacy violation. However, if exploited in a system processing sensitive data, it could lead to denial-of-service conditions impacting availability, which may indirectly affect compliance with availability requirements in some regulations.

Mitigation Strategies

Upgrade pypdf to version 6.16.1 or later using 'pip install --upgrade pypdf'. If upgrading is not possible, consider removing or restricting access to applications using vulnerable versions of pypdf.

Hi! I’m here to help you understand CVE-2026-84311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70