DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-84309: CVE-2026-84309: Infinite Loop and CPU Exhaustion in pypdf TreeObject.insert_child

#security #cve #cybersecurity

CVE-2026-84309: Infinite Loop and CPU Exhaustion in pypdf TreeObject.insert_child

Vulnerability ID: CVE-2026-84309
CVSS Score: 6.9
Published: 2026-09-01

An infinite loop vulnerability in pypdf versions prior to 6.16.0 allows attackers to trigger computational resource exhaustion and complete thread locking by supplying a malformed PDF with a cyclic tree structure. When modifying or rewriting document outlines containing circular references, the library endlessly traverses /Next pointers, resulting in application denial of service.

TL;DR

Infinite loop (CWE-835) in pypdf < 6.16.0 allows unauthenticated attackers to cause complete CPU exhaustion (DoS) via crafted PDF structures containing cyclic tree relationships.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-835
  • Attack Vector: Local (AV:L) / Indirectly Network
  • CVSS v4.0 Score: 6.9
  • Exploit Status: poc
  • CISA KEV Status: Not Listed
  • Impact: Denial of Service (CPU Exhaustion)

Affected Systems

  • pypdf Python library versions prior to 6.16.0
  • Python backend services processing PDF outlines, merges, or page updates
  • SaaS applications accepting untrusted user-uploaded PDF documents
  • pypdf: < 6.16.0 (Fixed in: 6.16.0)

Code Analysis

Commit: c9ba557

Implement visited set cycle detection in TreeObject.insert_child to prevent infinite loop.

Exploit Details

  • GitHub (pypdf tests): Programmatic proof of concept verifying infinite loop behavior when cycles are configured inside TreeObjects.

Mitigation Strategies

  • Upgrade the pypdf library to version 6.16.0 or higher.
  • Configure aggressive CPU and memory timeouts on document-parsing worker processes.
  • Enforce execution limits at the process container or task runner level (e.g., Celery, Gunicorn limits).

Remediation Steps:

  1. Identify all deployment containers and virtual environments containing pypdf.
  2. Execute 'pip install --upgrade pypdf>=6.16.0' to implement the fix.
  3. Confirm that pypdf environments are running the safe version via 'python -c "import pypdf; print(pypdf.version)"'.
  4. Implement and test processing timeouts on incoming file uploads.

References

Read the full report for CVE-2026-84309 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)