CVE-2026-84311

The record

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

Affected packages

Related vulnerabilities

• CVE-2026-106576 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-834
• CVE-2026-53493 containerd is an open-source container runtime. CWE-834
• CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-834
• CVE-2026-16497 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could… CWE-834
• CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. CWE-834
• CVE-2026-77357 Mesop is a Python-based UI framework that allows users to build web applications. CWE-834
• CVE-2026-71852 pypdf is a free and open-source pure-python PDF library. CWE-834
• CVE-2026-59644 In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit… CWE-834