DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-84310: CVE-2026-84310: Algorithmic Complexity Exhaustion in pypdf

#security #cve #cybersecurity

CVE-2026-84310: Algorithmic Complexity Exhaustion in pypdf

Vulnerability ID: CVE-2026-84310
CVSS Score: 4.8
Published: 2026-09-01

An algorithmic complexity vulnerability in the pypdf library before version 6.16.1 allows remote or local attackers to cause an application denial of service. The flaw is triggered via maliciously crafted PDF documents that utilize either deeply nested outlines or exponential Directed Acyclic Graph (DAG) structures in Form XObjects.

TL;DR

A resource exhaustion vulnerability in pypdf allows local and remote denial of service via unbounded recursion in outline retrieval and exponential node expansion in Form XObject parsing.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-405, CWE-834
  • Attack Vector: Local / User Interaction (Parsing a maliciously crafted PDF file)
  • CVSS v4.0 Score: 4.8
  • Impact: Denial of Service (CPU & Memory Exhaustion)
  • Exploit Status: Proof of Concept (PoC) documented
  • KEV Status: Not Listed

Affected Systems

  • Applications utilizing the pypdf Python library for PDF parsing, text extraction, or outline processing.
  • pypdf: < 6.16.1 (Fixed in: 6.16.1)

Code Analysis

Commit: d91ab70

Fix DoS issues related to outlines and XForms

Exploit Details

  • GitHub Pull Request: The regression tests contained in this pull request describe the precise steps to construct the exponential Directed Acyclic Graph (DAG) structures using Form XObjects to trigger the CPU hang.

Mitigation Strategies

  • Upgrade the pypdf library to version 6.16.1 or higher.
  • Implement process-level execution timeouts for all document parsing tasks.
  • Deploy static analysis detection rules to identify anomalously structured PDF files before processing.

Remediation Steps:

  1. Identify all microservices and processing pipelines using the pypdf dependency.
  2. Update requirements.txt, Pipfile, or pyproject.toml to enforce pypdf>=6.16.1.
  3. Run pip install --upgrade pypdf to apply the security patch locally and in CI/CD environments.
  4. Configure OS-level resource limits or Celery worker timeouts to automatically terminate long-running parsing tasks.

References

Read the full report for CVE-2026-84310 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)