CVE-2026-84311: CVE-2026-84311: Algorithmic Complexity Denial of Service in pypdf

#security #cve #cybersecurity

CVE-2026-84311: Algorithmic Complexity Denial of Service in pypdf

Vulnerability ID: CVE-2026-84311
CVSS Score: 4.8
Published: 2026-09-01

CVE-2026-84311 (GHSA-763m-79hh-57f2) is an algorithmic complexity Denial of Service (DoS) vulnerability in the pypdf library. Prior to version 6.16.1, the library does not place limits on iterations during the parsing of PDF document outlines and recursive Form XObject (XForm) expansions. An attacker can craft a malicious, highly compressed PDF document containing nested structures which, when parsed, trigger exponential iteration paths, resulting in severe CPU and memory exhaustion.

TL;DR

pypdf prior to version 6.16.1 is vulnerable to an algorithmic complexity Denial of Service (DoS) attack, resembling a 'Billion Laughs' entity expansion, via crafted nested Form XObjects or extremely deep outline trees.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-834 (Excessive Iteration)
Attack Vector: Local (via untrusted file processing)
CVSS Score: 4.8 (Medium)
Exploit Status: Proof-of-Concept Available
CISA KEV Status: Not Listed
Impact: Application-level Denial of Service (CPU/Memory Exhaustion)
Patched Version: 6.16.1

Affected Systems

Python backend applications parsing untrusted PDF uploads
Document indexing and full-text extraction microservices
Client-side Python applications processing user-supplied PDF documents
pypdf: < 6.16.1 (Fixed in: 6.16.1)

Code Analysis

Commit: d91ab70

Implemented global iteration and depth recursion limits for outlines and XObjects

Exploit Details

GitHub: Proof-of-concept tests and replication files contained within the official pull request

Mitigation Strategies

Upgrade pypdf to version 6.16.1 or higher to apply hard traversal limits
Set strict operating system and container resource caps (CPU, memory, ulimit) for PDF parsing workers
Implement application-level timeouts using multiprocessing to isolate and terminate hung processes
Validate and monitor application log entries for recursion warnings and LimitReachedError exceptions

Remediation Steps:

Identify all Python virtual environments and service dependencies running pypdf
Upgrade the package to a safe version: pip install --upgrade pypdf>=6.16.1
Deploy configuration changes to restrict CPU/Memory resources on PDF rendering microservices
Configure SIEM alerts to capture pypdf warning logs indicating exceeded XObject or outline traversal limits

References

Read the full report for CVE-2026-84311 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community