SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-84309

MEDIUM · CVSS 6.9 EPSS 0.13% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-01 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The pypdf library prior to version 6.16.0 is vulnerable to an infinite loop caused by a crafted PDF with a cyclic tree structure, which can lead to denial of service conditions. This vulnerability primarily affects applications that utilize the pypdf library for PDF processing. Developers and organizations using pypdf should prioritize upgrading to version 6.16.0 to mitigate potential service interruptions.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-84309
Severity
MEDIUM
CVSS
6.9
EPSS
0.13%

Original NVD Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.