Summary
pypdf: Possible long runtimes/large memory usage when retrieving outlines
Advisory details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-96960
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
- MEDIUMCVE-2026-70162
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
- MEDIUMCVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
- MEDIUMCVE-2026-53493
Containerd has image-pull DoS via crafted OCI index graph amplification
- HIGHCVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- MEDIUMCVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects