CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
CVE-2026-84311- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2026-69607
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
EUVD-2026-69607- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-763m-79hh-57f2
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
- Record
GHSA-763m-79hh-57f2- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
NVD
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
CVE-2026-84311- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-834
- Updated
- 2026-11-02
OSV
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
CVE-2026-84311- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-84311
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
DEBIAN-CVE-2026-84311- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
Show 4 moreShow less
OSVGHSA-763m-79hh-57f2
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
- Record
GHSA-763m-79hh-57f2- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-834
- Updated
- 2026-11-02
OSVPYSEC-2026-3911
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
- Record
PYSEC-2026-3911- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-84311
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
- Record
UBUNTU-CVE-2026-84311- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1789369936 No score
TuxCare security update for pypdf (8 CVEs)
TuxCare rebuilt pypdf to address 8 CVEs. Fixed in 5.9.0.post17+tuxcare.
- Record
CLSA-2026-1789369936- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pypdfPyPI |
before 6.16.1 | 6.16.1 |
pypdfTuxCare:PyPI From an advisory covering 7 CVEs |
5.9.0 up to 5.9.0.post17+tuxcare, plus listed versions 5.9.0.post1+tuxcare5.9.0.post10+tuxcare5.9.0.post11+tuxcare5.9.0.post12+tuxcare5.9.0.post13+tuxcare Show 11 moreShow less5.9.0.post14+tuxcare5.9.0.post15+tuxcare5.9.0.post16+tuxcare5.9.0.post2+tuxcare5.9.0.post3+tuxcare5.9.0.post4+tuxcare5.9.0.post5+tuxcare5.9.0.post6+tuxcare5.9.0.post7+tuxcare5.9.0.post8+tuxcare5.9.0.post9+tuxcare |
5.9.0.post17+tuxcare |
pypdfDebian:12 |
All versions, plus listed versions 3.17.4-13.4.1-13.4.1-1+deb12u14.0.0-14.0.0-1~exp1 Show 13 moreShow less4.0.1-14.0.2-14.1.0-14.2.0-14.3.1-15.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:13 |
All versions, plus listed versions 5.4.0-16.19.0-16.21.0-16.21.1-16.21.4-16.9.0-16.9.2-16.9.2-2 |
None known |
pypdfDebian:14 |
before 6.19.0-1, plus listed versions 5.4.0-16.9.0-16.9.2-16.9.2-2 |
6.19.0-1 |
pypdf2Debian:12 |
All versions, plus listed versions 2.12.1-32.12.1-3+deb12u12.12.1-4 |
None known |
pypdfPyPI |
before 6.16.1, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.21.31.41.51.61.71.81.93.1.03.10.03.11.03.11.13.12.03.12.13.12.23.13.03.14.03.15.03.15.13.15.23.15.33.15.43.15.53.16.03.16.13.16.23.16.33.16.43.17.03.17.13.17.23.17.33.17.43.2.03.2.13.3.03.4.03.4.13.5.03.5.13.5.23.6.03.7.03.7.1 |
6.16.1 |
pypdf2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.23+git20141008-11.25.1-11.25.1-1ubuntu0.1~esm11.25.1-1ubuntu0.1~esm2 |
None known |
pypdf2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.26.0-21.26.0-2ubuntu0.1~esm11.26.0-2ubuntu0.1~esm2 |
None known |
pypdf2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.26.0-21.26.0-3ubuntu11.26.0-3ubuntu1.20.04.11.26.0-3ubuntu1.20.04.2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pypdf2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.26.0-41.26.0-4ubuntu0.22.04.11.26.0-4ubuntu0.22.04.2 |
None known |
pypdfUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.1-13.17.4-14.0.0-14.0.1-14.0.2-1 |
None known |
pypdf2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.12.1-32.12.1-4 |
None known |
pypdfUbuntu:26.10 |
All versions, plus listed versions 6.9.2-16.9.2-2 |
None known |
pypdfUbuntu:26.04:LTS |
All versions, plus listed versions 5.4.0-16.9.2-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84311 is a medium vulnerability (CVSS 4.8) in Py-pdf Pypdf, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 2nd percentile. Fixed in pypdf 6.16.1.
References
github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2
Left out here: 64 versions. The JSON record has them.