{"vulnerability": "ghsa-jp53-mhqp-8xcg", "sightings": [{"uuid": "546d94a9-ccb0-47e9-b5da-8b122e210878", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jp53-mhqp-8xcg", "type": "seen", "source": "https://gist.github.com/alon710/d55e9844c43e78f042db258784a22ae0", "content": "# CVE-2026-84309: CVE-2026-84309: Infinite Loop and CPU Exhaustion in pypdf TreeObject.insert_child\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84309\n\n## Summary\nAn infinite loop vulnerability in pypdf versions prior to 6.16.0 allows attackers to trigger computational resource exhaustion and complete thread locking by supplying a malformed PDF with a cyclic tree structure. When modifying or rewriting document outlines containing circular references, the library endlessly traverses /Next pointers, resulting in application denial of service.\n\n## TL;DR\nInfinite loop (CWE-835) in pypdf < 6.16.0 allows unauthenticated attackers to cause complete CPU exhaustion (DoS) via crafted PDF structures containing cyclic tree relationships.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Local (AV:L) / Indirectly Network\n- **CVSS v4.0 Score**: 6.9\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- pypdf Python library versions prior to 6.16.0\n- Python backend services processing PDF outlines, merges, or page updates\n- SaaS applications accepting untrusted user-uploaded PDF documents\n- **pypdf**: < 6.16.0 (Fixed in: `6.16.0`)\n\n## Mitigation\n\n- Upgrade the pypdf library to version 6.16.0 or higher.\n- Configure aggressive CPU and memory timeouts on document-parsing worker processes.\n- Enforce execution limits at the process container or task runner level (e.g., Celery, Gunicorn limits).\n\n**Remediation Steps:**\n1. Identify all deployment containers and virtual environments containing pypdf.\n2. Execute 'pip install --upgrade pypdf>=6.16.0' to implement the fix.\n3. Confirm that pypdf environments are running the safe version via 'python -c \"import pypdf; print(pypdf.__version__)\"'.\n4. Implement and test processing timeouts on incoming file uploads.\n\n## References\n\n- [GitHub Security Advisory GHSA-jp53-mhqp-8xcg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg)\n- [CVE-2026-84309 Record](https://www.cve.org/CVERecord?id=CVE-2026-84309)\n- [pypdf Pull Request #3964](https://github.com/py-pdf/pypdf/pull/3964)\n- [Fix Commit c9ba557](https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b)\n- [pypdf 6.16.0 Release Tag](https://github.com/py-pdf/pypdf/releases/tag/6.16.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84309) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T05:32:13.277199Z"}]}