{"vulnerability": "cve-2026-8431", "sightings": [{"uuid": "9ded00ea-64d5-4bdd-a501-880b9d0c28e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84311", "type": "seen", "source": "https://gist.github.com/alon710/98eba2f66fc3c02fefd49fa02ee5009a", "content": "# CVE-2026-84311: CVE-2026-84311: Algorithmic Complexity Denial of Service in pypdf\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84311\n\n## Summary\nCVE-2026-84311 (GHSA-763m-79hh-57f2) is an algorithmic complexity Denial of Service (DoS) vulnerability in the pypdf library. Prior to version 6.16.1, the library does not place limits on iterations during the parsing of PDF document outlines and recursive Form XObject (XForm) expansions. An attacker can craft a malicious, highly compressed PDF document containing nested structures which, when parsed, trigger exponential iteration paths, resulting in severe CPU and memory exhaustion.\n\n## TL;DR\npypdf prior to version 6.16.1 is vulnerable to an algorithmic complexity Denial of Service (DoS) attack, resembling a 'Billion Laughs' entity expansion, via crafted nested Form XObjects or extremely deep outline trees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-834 (Excessive Iteration)\n- **Attack Vector**: Local (via untrusted file processing)\n- **CVSS Score**: 4.8 (Medium)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n- **Impact**: Application-level Denial of Service (CPU/Memory Exhaustion)\n- **Patched Version**: 6.16.1\n\n## Affected Systems\n\n- Python backend applications parsing untrusted PDF uploads\n- Document indexing and full-text extraction microservices\n- Client-side Python applications processing user-supplied PDF documents\n- **pypdf**: < 6.16.1 (Fixed in: `6.16.1`)\n\n## Mitigation\n\n- Upgrade pypdf to version 6.16.1 or higher to apply hard traversal limits\n- Set strict operating system and container resource caps (CPU, memory, ulimit) for PDF parsing workers\n- Implement application-level timeouts using multiprocessing to isolate and terminate hung processes\n- Validate and monitor application log entries for recursion warnings and LimitReachedError exceptions\n\n**Remediation Steps:**\n1. Identify all Python virtual environments and service dependencies running pypdf\n2. Upgrade the package to a safe version: pip install --upgrade pypdf>=6.16.1\n3. Deploy configuration changes to restrict CPU/Memory resources on PDF rendering microservices\n4. Configure SIEM alerts to capture pypdf warning logs indicating exceeded XObject or outline traversal limits\n\n## References\n\n- [GitHub Security Advisory GHSA-763m-79hh-57f2](https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2)\n- [pypdf Fix Commit d91ab705fd81ed1a9cec175c6958600dea1a4942](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942)\n- [pypdf Pull Request #3966](https://github.com/py-pdf/pypdf/pull/3966)\n- [pypdf 6.16.1 Release Notes](https://github.com/py-pdf/pypdf/releases/tag/6.16.1)\n- [NVD CVE-2026-84311 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-84311)\n- [CVE.org CVE-2026-84311 Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-84311)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84311) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T04:31:59.056028Z"}, {"uuid": "177dd7ef-23d3-4192-a2b7-e5a0f03a7844", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84310", "type": "seen", "source": "https://gist.github.com/alon710/3521e58613b990dddef5bf0335b08c88", "content": "# CVE-2026-84310: CVE-2026-84310: Algorithmic Complexity Exhaustion in pypdf\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84310\n\n## Summary\nAn algorithmic complexity vulnerability in the pypdf library before version 6.16.1 allows remote or local attackers to cause an application denial of service. The flaw is triggered via maliciously crafted PDF documents that utilize either deeply nested outlines or exponential Directed Acyclic Graph (DAG) structures in Form XObjects.\n\n## TL;DR\nA resource exhaustion vulnerability in pypdf allows local and remote denial of service via unbounded recursion in outline retrieval and exponential node expansion in Form XObject parsing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-405, CWE-834\n- **Attack Vector**: Local / User Interaction (Parsing a maliciously crafted PDF file)\n- **CVSS v4.0 Score**: 4.8\n- **Impact**: Denial of Service (CPU & Memory Exhaustion)\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the pypdf Python library for PDF parsing, text extraction, or outline processing.\n- **pypdf**: < 6.16.1 (Fixed in: `6.16.1`)\n\n## Mitigation\n\n- Upgrade the pypdf library to version 6.16.1 or higher.\n- Implement process-level execution timeouts for all document parsing tasks.\n- Deploy static analysis detection rules to identify anomalously structured PDF files before processing.\n\n**Remediation Steps:**\n1. Identify all microservices and processing pipelines using the pypdf dependency.\n2. Update requirements.txt, Pipfile, or pyproject.toml to enforce pypdf>=6.16.1.\n3. Run pip install --upgrade pypdf to apply the security patch locally and in CI/CD environments.\n4. Configure OS-level resource limits or Celery worker timeouts to automatically terminate long-running parsing tasks.\n\n## References\n\n- [GitHub Advisory GHSA-23w6-3w8w-8484](https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484)\n- [Fix Commit](https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942)\n- [Pull Request #3966](https://github.com/py-pdf/pypdf/pull/3966)\n- [Release 6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1)\n- [CVE-2026-84310 Record](https://www.cve.org/CVERecord?id=CVE-2026-84310)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84310) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T03:31:51.137091Z"}]}