Quick answers
- Is CVE-2026-84310 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84310 being exploited in the wild.
- How severe is CVE-2026-84310?
- Medium severity, with a CVSS score of 4, published 1 September 2026.
- Which products and versions are affected?
- pypdf (PyPI) < 6.16.1, ECOSYSTEM:introduced=0,fixed=6.16.1.
- Is there a fix for CVE-2026-84310?
- Yes. pypdf (PyPI): upgrade to 6.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84310 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-84310?
- Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pypdf (PyPI): upgrade to 6.16.1 or later
pip install "pypdf>=6.16.1"
Technical details
This vulnerability is a denial-of-service (DoS) condition caused by asymmetric resource consumption and excessive iteration (CWE-405, CWE-834) in the outline parsing logic. When pypdf retrieves a document's outlines (bookmarks/table of contents), it does not adequately limit iteration depth or detect re-used nesting paths, allowing an attacker to craft a PDF that triggers quadratic or exponential processing time. The attack requires only local file access or the ability to supply a malicious PDF to an application; no authentication or user interaction beyond the victim opening/processing the file is needed. The affected versions are prior to 6.16.1, where the issue was remediated. A patch is available, and the fix was implemented in commit d91ab70.
Affected products
- py-pdf pypdf < 6.16.1
Identifiers
- CVE-2026-84310
- GHSA-23w6-3w8w-8484
- PYSEC-2026-3910
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in pypdf 6.16.1