CVE-2026-84311— pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Quick assessment
Affected
py-pdf pypdf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pypdf 是一个免费且开源的纯 Python PDF 处理库。在 6.16.1 版本之前，攻击者可以构造一个特定的 PDF 文件，导致 pypdf 中的 文件里 和 方法在遍历一个由重用的表单 XObject 构成的有向无环图（DAG）时，若每个表单对象多次调用其子对象，会生成指数级数量的遍历路径，从而引发长时间运行和高内存占用。该问题已在 6.16.1 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84311
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Source: CVE Program / CVE List V5
Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过度迭代
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84311
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84311
请登录查看更多情报信息。
Other References for CVE-2026-84311 (4)
-
https://github.com/py-pdf/pypdf/pull/3966 x_refsource_MISC
-
https://github.com/py-pdf/pypdf/releases/tag/6.16.1 x_refsource_MISC
-
https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2 x_refsource_CONFIRM
Same Patch Batch · py-pdf · 2026-09-01 · 3 CVEs total
| CVE-2026-84309 | 6.9 MEDIUM | pypdf: Possible infinite loop for TreeObject.insert_child |
| CVE-2026-84310 | 4.8 MEDIUM | pypdf: Possible long runtimes/large memory usage when retrieving outlines |
IV. Related Vulnerabilities
Same product: pypdf
-
CVE-2026-84310
pypdf: Possible long runtimes/large memory usage when retrie -
CVE-2026-84309
pypdf: Possible infinite loop for TreeObject.insert_child -
CVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read -
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C
Same vendor: py-pdf
-
CVE-2026-84310
pypdf: Possible long runtimes/large memory usage when retrie -
CVE-2026-84309
pypdf: Possible infinite loop for TreeObject.insert_child -
CVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read -
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C
Same weakness: CWE-834
-
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C -
CVE-2026-59644
MLS hash-ratchet honours arbitrary 32-bit generation counter -
CVE-2026-64641
Next.js: Denial of Service in App Router using Server Action -
CVE-2026-48156
pypdf: Possible long runtimes for zero-only width values in -
CVE-2026-41313
pypdf: Possible long runtimes for wrong size values in incre
V. Comments for CVE-2026-84311
No comments yet