CVE-2026-84311

In pypdf (Python PDF library) prior to version 6.16.1, an attacker can craft a PDF that causes _get_outline in _doc_common.py to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.

pypdf prior to 6.15.0 has a vulnerability causing long runtimes when the function read_until_whitespace in pypdf/_utils.py reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost.

pypdf prior to 6.15.0 is vulnerable to excessive memory consumption when parsing crafted PDFs, as the parse_bfrange function in pypdf/_cmap.py handles unusually large tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in version 6.15.0.

A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.

In pypdf library prior to version 6.14.1, a vulnerability was found causing an infinite loop when processing inline images in PDF page content streams. An attacker can craft a malicious PDF with a not terminated inline image, leading to a hang during text extraction.

The pypdf library prior to version 6.14.2 is vulnerable to a DoS attack due to an infinite loop when parsing PDF files. An attacker can craft a malicious PDF with a not terminated inline image using ASCII85 or ASCIIHex filters, causing the process to hang.

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with declared image size values much larger than the actual data, causing excessive memory usage during image parsing. This can be exploited for a denial-of-service (DoS) attack by exhausting memory resources.

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with multiple malformed cross-reference streams, causing long runtimes for recovering broken cross-reference table entries. This leads to excessive CPU usage and processing delays.

The pypdf library before version 6.13.3 contains a DoS vulnerability. A specially crafted PDF can cause excessive memory usage because the MAX_DECLARED_STREAM_LENGTH constant is sometimes ignored when parsing a content stream without a /Length value.