CVE-2026-84309 py-pdf CVE debrief

Who should care

Defenders responsible for maintaining and updating the pypdf library should prioritize updating to version 6.16.0 or later to prevent potential denial-of-service attacks. This includes operators, security teams, and vulnerability management teams that use the pypdf library in their products or services. Additionally, defenders who are responsible for reviewing and testing PDF processing code for potential vulnerabilities should also be aware of this issue.

Why it matters

Defenders should prioritize updating to version 6.16.0 or later to prevent potential denial-of-service attacks due to the vulnerability in the pypdf library.

• Potential denial-of-service attacks
• Increased risk of system crashes or freezes

Technical summary

The pypdf library is vulnerable to a denial-of-service attack due to an infinite loop caused by a cyclic tree structure in a PDF. This issue is fixed in version 6.16.0. The vulnerability is caused by the TreeObject.insert_child function in pypdf/generic/_data_structures.py, which can follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. Defenders should prioritize updating to version 6.16.0 or later to prevent potential denial-of-service attacks. The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize updating to version 6.16.0 or later to prevent potential denial-of-service attacks.

Recommended defensive actions

• Update to version 6.16.0 or later
• Review and test PDF processing code for potential vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and affected versions. The pypdf library is a free and open-source pure-python PDF library. An attacker can craft a PDF with a cyclic tree structure that causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0. Defenders should verify the affected scope,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.