mediumVulnerability
CVE-2026-84309
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.
Properties
- severity
- medium
- summary
- pypdf: Possible infinite loop for TreeObject.insert_child
- epss_score
- 0.00187
- retrieved_at
- 2026-10-16T11:46:58+00:00
- ghsa_published
- 2026-09-01T21:20:20Z
- source_url
- https://github.com/advisories/GHSA-jp53-mhqp-8xcg
- ghsa_updated
- 2026-09-01T21:21:21Z
- ghsa_id
- GHSA-jp53-mhqp-8xcg
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-84309
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- published_at
- 2026-09-01T20:17:25.027
- last_modified
- 2026-09-09T16:49:20.627
- epss_percentile
- 0.07716
Related Entities (6)
DESCRIBED_BY (1)
→[Source]NVD
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]pip/pypdf
AFFECTS (1)
→[Software]pip/pypdf
HAS_WEAKNESS (1)
→[Weakness]Loop with Unreachable Exit Condition ('Infinite Loop')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph