CVE-2026-84310: pypdf: Possible long runtimes/large memory usage when retrieving outlines

September 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.

References

github.com/advisories/GHSA-23w6-3w8w-8484
github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942
github.com/py-pdf/pypdf/pull/3966
github.com/py-pdf/pypdf/releases/tag/6.16.1
github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484
nvd.nist.gov/vuln/detail/CVE-2026-84310

Code Behaviors & Features

Detect and mitigate CVE-2026-84310 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →