CVE-2026-84310: 
Python vulnerability analysis and mitigation

CVE-2026-84310 is a Denial of Service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by unbounded outline traversal in pypdf/_doc_common.py. Prior to version 6.16.1, an attacker can craft a malicious PDF with a large number of outline entries or deeply nested, reused outline paths that causes the _get_outline function to consume excessive CPU time and memory. The vulnerability was disclosed on September 1, 2026, and affects all pypdf versions before 6.16.1. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is the absence of global entry-count and nesting-depth limits during outline traversal in pypdf/_doc_common.py's _get_outline function, classified under CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-834 (Excessive Iteration), and CWE-405 (Asymmetric Resource Consumption/Amplification). An attacker crafts a PDF document with either an extremely large number of outline entries or deeply nested outlines that reuse paths, causing the traversal loop to iterate without bound. The fix introduced in PR #3966 adds two hard limits: OUTLINE_MAX_ENTRIES = 100_000 and OUTLINE_MAX_DEPTH = 100, enforced via a shared _TraversalState object passed through recursive calls, raising a LimitReachedError when either threshold is exceeded. Exploitation requires user interaction — specifically, an application or user must open and process the crafted PDF using pypdf (GitHub Advisory, GitHub PR #3966).

Successful exploitation causes the affected application to consume excessive CPU time and memory while processing a malicious PDF, resulting in a Denial of Service condition — the service may become unresponsive or crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Applications that automatically process user-supplied PDFs (e.g., document management systems, web upload handlers) are at elevated risk, as an unauthenticated attacker could trigger the condition by submitting a crafted file (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local or network delivery of a crafted PDF file and user interaction to trigger outline processing (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious PDF: Create a PDF document with either an extremely large number of outline (bookmark) entries or deeply nested outline structures that reuse paths, designed to exceed pypdf's processing capacity.
2. Deliver the PDF: Submit the crafted PDF to a target application that uses pypdf to process documents — for example, via a file upload form, email attachment, or shared document repository.
3. Trigger outline retrieval: Cause the application to access the document's outline (e.g., by rendering a table of contents or programmatically calling reader.outline), which invokes _get_outline in pypdf/_doc_common.py.
4. Exhaust resources: The unbounded traversal loop iterates over the malicious outline structure without limit, consuming excessive CPU time and memory until the process becomes unresponsive, crashes, or is killed by the OS — resulting in a Denial of Service for the affected service (GitHub Advisory, GitHub PR #3966).

• Process Behavior: Python processes consuming abnormally high CPU or memory while processing PDF files; processes that hang or become unresponsive during PDF outline extraction.
• Logs: Application-level errors or timeouts associated with PDF processing; LimitReachedError exceptions in logs (only on patched versions); OOM (Out of Memory) killer events in system logs (/var/log/syslog, dmesg) referencing Python processes.
• File System: Presence of unusually structured PDF files with deeply nested or extremely large outline sections submitted to upload directories or temporary processing folders.

Upgrade pypdf to version 6.16.1 or later, which introduces hard limits of 100,000 outline entries (OUTLINE_MAX_ENTRIES) and 100 nesting levels (OUTLINE_MAX_DEPTH) in the _get_outline function. For deployments that cannot upgrade immediately, the changes from PR #3966 can be applied manually as a workaround. Additionally, consider implementing OS-level resource limits (CPU time, memory) on processes that handle user-supplied PDFs, and validate or sandbox PDF inputs before processing (GitHub Advisory, pypdf Release 6.16.1).