CVE-2026-84309: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in py-pdf pypdf
Description
CVE-2026-84309 is a medium severity vulnerability in the py-pdf pypdf library prior to version 6.16.0. It involves an infinite loop caused by a crafted PDF with a cyclic tree structure that triggers the TreeObject.insert_child function to follow /Next links indefinitely. This issue is resolved in pypdf version 6.16.0.
CVSS v4.0
Score 6.9medium
Affected software
py-pdf
pypdf
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in pypdf versions before 6.16.0 where an attacker can craft a PDF containing a cyclic tree structure. When the library's TreeObject.insert_child method processes this structure, it follows /Next links indefinitely, causing an infinite loop. This can occur during a writing code path that inserts a child node. The infinite loop may lead to denial of service conditions by causing the application to hang or consume excessive resources. The issue is fixed in version 6.16.0.
Potential Impact
An attacker who can supply a malicious PDF to an application using a vulnerable pypdf version can cause the application to enter an infinite loop, potentially leading to denial of service by resource exhaustion or application hang. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
Upgrade pypdf to version 6.16.0 or later, where this infinite loop vulnerability is fixed. No other mitigations are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.079Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a973099acd9273b49257e11
Added to database: 09/01/2026, 20:07:53 UTC
Last enriched: 09/17/2026, 02:48:37 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.