mediumVulnerability
CVE-2026-84310
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. ### Patches This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3966](https://github.com/py-pdf/pypdf/pull/3966).
Properties
- ghsa_id
- GHSA-23w6-3w8w-8484
- severity
- medium
- summary
- pypdf: Possible long runtimes/large memory usage when retrieving outlines
- cve_id
- CVE-2026-84310
- is_ghsa_only
- false
- ghsa_published
- 2026-09-01T21:28:37Z
- source_url
- https://github.com/advisories/GHSA-23w6-3w8w-8484
- ghsa_updated
- 2026-09-01T21:28:39Z
Related Entities (5)
VULNERABLE_TO (1)
←[Software]pip/pypdf
AFFECTS (1)
→[Software]pip/pypdf
HAS_WEAKNESS (2)
→[Weakness]Excessive Iteration
→[Weakness]Asymmetric Resource Consumption (Amplification)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph