Denial of Service Vulnerability in pypdf Library by PyPDF

CVE-2026-84311

What is CVE-2026-84311?

The pypdf library, a pure Python PDF processing tool, is susceptible to a Denial of Service (DoS) vulnerability that allows attackers to create malicious PDFs. These PDFs exploit the library's PageObject._extract_text and extract_xform_text methods, causing them to enter an exponentially complex traversal path. This can lead to excessive memory consumption and prolonged runtimes, potentially disrupting services that rely on this library. Users are urged to upgrade to version 6.16.1 or later to mitigate this issue.

References