CVE-2026-84311

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1

Description An attacker can craft a PDF file that leads to excessive memory consumption and long runtimes. This occurs when extracting text from a page containing numerous reused form XObjects, where a form invokes a child multiple times. This creates exponentially many traversal paths within the directed acyclic graph (a graph with no cycles) of the XObjects, specifically affecting the PageObject. extract text() and PageObject.extract xform text() functions.

Recommendations Update to version 6.16.1. As a temporary workaround, apply the changes from PR #3966.