CVE-2026-84311: 
Python vulnerability analysis and mitigation

CVE-2026-84311 is a Denial of Service vulnerability in pypdf, a free and open-source pure-Python PDF library. An attacker can craft a malicious PDF that causes pypdf/_page.py functions PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects where each form invokes a child multiple times, creating exponentially many traversal paths and causing excessive CPU usage and memory consumption. All versions of pypdf prior to 6.16.1 are affected. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-834 (Excessive Iteration). When pypdf processes a PDF page's XForm objects during text extraction, it traverses a directed acyclic graph (DAG) of form XObjects without enforcing an upper bound on the total number of invocations. Because a single form can reference a child XObject multiple times, the traversal count grows exponentially with nesting depth, leading to unbounded CPU and memory consumption. The fix introduced in PR #3966 adds a _TraversalState dataclass to track invocation counts and enforces a hard limit of 5,000 XForm invocations per extraction (MAX_XFORM_INVOCATIONS_PER_EXTRACTION) and 100,000 outline entries (OUTLINE_MAX_ENTRIES) with a depth cap of 100 (OUTLINE_MAX_DEPTH) (GitHub Advisory, Fix PR, Patch Commit).

Successful exploitation causes the affected application to consume excessive memory and CPU resources, rendering it unresponsive — a classic Denial of Service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Any application that processes untrusted PDF files using pypdf (e.g., document management systems, web upload handlers, automated PDF processors) is at risk of service disruption (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim application or user must open or process the crafted PDF — and the attack vector is local, limiting the attack surface to scenarios where an attacker can supply a malicious PDF to a pypdf-based processing pipeline (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious PDF: Create a PDF document containing a page with form XObjects (XForms) structured as a directed acyclic graph where each parent XForm references a child XForm multiple times (e.g., a form that invokes the same child 10 times, which itself invokes another child 10 times, creating 10^n traversal paths).
2. Deliver the PDF: Submit the crafted PDF to a target application that uses pypdf for text extraction — for example, via a file upload endpoint, email attachment processor, or document conversion service.
3. Trigger text extraction: Cause the application to call page.extract_text() or equivalent on the page containing the malicious XForm structure, which internally invokes PageObject._extract_text and PageObject.extract_xform_text.
4. Achieve DoS: The exponential traversal of XForm nodes causes the process to consume all available CPU and memory, making the application unresponsive or causing an out-of-memory crash (GitHub Advisory, Fix PR).

• Process Behavior: Python processes consuming abnormally high CPU (near 100%) or memory for extended periods when processing PDF files; processes that hang or become unresponsive during PDF text extraction.
• Logs: Application logs showing timeouts or out-of-memory errors during PDF processing; pypdf warning messages such as "Exceeded 5000 form XObject invocations while extracting text; further form content is skipped" (present in patched versions only).
• File System: Presence of unusually structured PDF files with deeply nested or multiply-referenced XForm objects submitted via upload directories or processing queues.

Upgrade pypdf to version 6.16.1 or later, which enforces limits on XForm invocations (5,000 per extraction) and outline traversal depth (100 levels, 100,000 entries). For deployments that cannot upgrade immediately, the changes from PR #3966 can be applied manually as a workaround. Additionally, consider implementing resource limits (CPU time, memory) on PDF processing workers, sandboxing PDF processing, and restricting PDF ingestion to trusted sources where possible (GitHub Advisory, pypdf Release, Fix PR).

The vulnerability was reported by researcher zikk090 and analyzed and patched by pypdf maintainer stefan6419846. The fix was merged on August 14, 2026, and the patched release (6.16.1) was published the same day. The NixOS/nixpkgs project opened a tracking issue (NixOS/nixpkgs#559063) to update their python3Packages.pypdf package to address the security issue, indicating prompt downstream response (Fix PR, pypdf Release).