CVE-2026-84310— pypdf: Possible long runtimes/large memory usage when retrieving outlines
Quick assessment
Affected
py-pdf pypdf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pypdf 是一个免费且开源的纯 Python PDF 处理库。在 6.16.1 版本之前，攻击者可以构造一个 PDF 文件，使得 pypdf 在通过 中的 方法获取文档大纲时，若大纲包含大量条目或具有深度嵌套的重复路径，会因缺乏对总条目数和嵌套深度的全局限制，导致运行时间过长并消耗大量内存。该问题已在 6.16.1 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84310
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pypdf: Possible long runtimes/large memory usage when retrieving outlines
Source: CVE Program / CVE List V5
Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不对称的资源消耗(放大攻击)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84310
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84310
请登录查看更多情报信息。
Other References for CVE-2026-84310 (4)
-
https://github.com/py-pdf/pypdf/pull/3966 x_refsource_MISC
-
https://github.com/py-pdf/pypdf/releases/tag/6.16.1 x_refsource_MISC
-
https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484 x_refsource_CONFIRM
Same Patch Batch · py-pdf · 2026-09-01 · 3 CVEs total
| CVE-2026-84309 | 6.9 MEDIUM | pypdf: Possible infinite loop for TreeObject.insert_child |
| CVE-2026-84311 | 4.8 MEDIUM | pypdf: Possible long runtimes/large memory usage when extracting XForm objects |
IV. Related Vulnerabilities
Same product: pypdf
-
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extrac -
CVE-2026-84309
pypdf: Possible infinite loop for TreeObject.insert_child -
CVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read -
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C
Same vendor: py-pdf
-
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extrac -
CVE-2026-84309
pypdf: Possible infinite loop for TreeObject.insert_child -
CVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read -
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C
Same weakness: CWE-405
-
CVE-2026-54874
Excessive Memory Use Buffering DTLS Records for a Future Epo -
CVE-2026-23934
Frontend DoS via the validate.api.exists action -
CVE-2026-23930
Frontend DoS via the popup.testtriggerexpr action -
CVE-2026-72914
Mastodon: Exhausting data by an unauthenticated request to t -
CVE-2026-54224
Denial of Service in UBB.threads
V. Comments for CVE-2026-84310
No comments yet