CVE-2026-84309: pypdf: Possible infinite loop for TreeObject.insert_child

September 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insert_child is involved.

References

github.com/advisories/GHSA-jp53-mhqp-8xcg
github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b
github.com/py-pdf/pypdf/pull/3964
github.com/py-pdf/pypdf/releases/tag/6.16.0
github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg
nvd.nist.gov/vuln/detail/CVE-2026-84309

Code Behaviors & Features

Detect and mitigate CVE-2026-84309 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →