PT-2026-84461 · Pypi · Pypdf

CVE-2026-84309

·

Published

2026-08-13

·

Updated

2026-09-10

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.0
Description An attacker can craft a PDF with a cyclic tree structure that triggers an infinite loop. This occurs when a writing code path utilizes the TreeObject.insert child() function in pypdf/generic/ data structures.py, causing it to follow /Next links indefinitely.
Recommendations Update to version 6.16.0. As a temporary workaround, apply the changes from PR #3964.

Exploit

Fix

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-14262
CVE-2026-84309
GHSA-JP53-MHQP-8XCG
OPENSUSE-SU-2026:11726-1
PYSEC-2026-3913

Affected Products

Pypdf