CVE-2026-84309: pypdf: Possible infinite loop for TreeObject.insert_child
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.16.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pypdf versions before 6.16.0 are exposed when they process an attacker-crafted PDF through a writing code path that inserts a child into a TreeObject.
What does an attacker need to do to trigger the problem?
The attacker must provide a PDF with a cyclic tree structure. When pypdf follows the tree's /Next links during TreeObject.insert_child, it can loop indefinitely.
What should teams do to remediate the issue?
Upgrade pypdf to version 6.16.0, which fixes the infinite-loop condition.