CVE-2026-84310: CWE-405: Asymmetric Resource Consumption (Amplification) in py-pdf pypdf

The pypdf library, a pure-Python PDF processing tool, has a vulnerability (CVE-2026-84310) affecting versions before 6.16.1. An attacker can craft a PDF file that triggers the _get_outline function in pypdf/_doc_common.py to consume excessive CPU time and memory. This happens because the traversal logic does not enforce global limits on the number of entries or the depth of nested reused paths when retrieving document outlines. The vulnerability is classified under CWE-405 (Asymmetric Resource Consumption) and CWE-834 (Excessive Resource Consumption). The issue is resolved in version 6.16.1.

Exploitation of this vulnerability can lead to denial of service conditions by causing the pypdf library to consume large amounts of memory and CPU resources, potentially slowing down or crashing applications that process maliciously crafted PDFs. There is no indication of privilege escalation, data disclosure, or code execution. The CVSS 4.8 score reflects a medium impact primarily due to resource exhaustion with local attack vector and low privileges required.

Upgrade to pypdf version 6.16.1 or later, where this vulnerability has been fixed by adding limits on entry count and nesting depth during outline retrieval. No other mitigation is indicated or necessary once the fixed version is deployed.