pypdf CVE-2026-84309

The target application must use pypdf prior to 6.16.0 AND must invoke the write path on a user-supplied PDF - specifically, a code path that calls TreeObject.insert_child, such as merging PDFs, adding annotations, or inserting bookmarks. Applications that only perform read-only operations (text extraction, thumbnail generation, metadata inspection) are not affected. No authentication is required at the library level; any endpoint that accepts an untrusted PDF file and then writes or modifies it using pypdf is at risk. Exploitation is further limited to environments without process-level timeouts or resource controls, since a timeout would terminate the hung worker rather than allow sustained DoS.

The official CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VA:H, score 6.9) models the vulnerability from the library's perspective - a malicious file on the local filesystem. In realistic server-side deployments, pypdf often processes PDFs received over the network (document management systems, PDF conversion APIs, report generators), making the effective attack surface materially wider than AV:L implies. Impact is purely availability: there is no confidentiality or integrity effect. The vulnerability is exclusively on the write path - applications that only parse/extract text from PDFs without invoking insert_child are not affected. No EPSS data was provided and no KEV entry exists, suggesting no observed in-the-wild exploitation at time of analysis. The functional PoC in the fix PR meaningfully lowers the exploitation bar for anyone targeting a vulnerable service.

An attacker submits a crafted PDF - where /Next links form a cycle among three or more TreeObject nodes - to a web service that uses pypdf to transform or annotate documents (e.g., add a watermark, merge pages). When the service calls insert_child on the malicious tree structure during the write operation, the traversal loop never terminates, the worker process hangs indefinitely, and repeated submissions can exhaust the worker pool, rendering the service unavailable. A proof-of-concept replicating this exact three-node cycle is included in fix PR #3964.