CVE catalog

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse

[CVE catalog]

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Sep 1, 2026, 8:03:13 PM UTC
Updated: Sep 1, 2026, 9:18:46 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.14% · Oct 25, 2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pypdf	sid	`6.21.1-1`	fixed
Debian	pypdf	forky	`6.21.1-1`	fixed
Debian	pypdf	trixie	`5.4.0-1`	vulnerable
Debian	pypdf	bookworm	`3.4.1-1+deb12u1`	vulnerable
Debian	pypdf2	bookworm	`2.12.1-3+deb12u1`	vulnerable
PyPI	pypdf	Not reported	`6.16.1`	fixed
PyPI	pypdf	Not reported	`6.16.1`	fixed
Cpe	pypdf	Not reported	`6.16.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pypdf	source	sid	`6.19.0-1`	not yet assigned	Not reported	[1146476]
Debian	pypdf	source	forky	`6.19.0-1`	not yet assigned	Not reported	[1146476]
Debian	pypdf	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1146476]
Debian	pypdf	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1146476]
Debian	pypdf2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
PyPI	pypdf	PyPI	Not reported	`6.16.1`	Not reported	PYSEC-2026-3911	Not reported
PyPI	pypdf	PyPI	Not reported	`6.16.1`	Not reported	GHSA-763M-79HH-57F2	Not reported
Cpe	pypdf	cpe	Not reported	`6.16.1`	Not reported	NVD-CVE-2026-84311	Not reported

[Debian bug #1146476]

Notes

[trixie] pypdf: Minor issue [bookworm] pypdf: Minor issue [bookworm] pypdf2: Minor issue, DoS

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-pypdf]Affected
Source package: [pypdf]
Details (2)
- 3.4.1-1+deb12u1 · all · bookworm
  Affected
  nvd · pypdf · debian · bookworm; nvd · pypdf · debian · 12
- 3.4.1-1+deb12u1 · all · bookworm
  Affected
  nvd · pypdf · debian · bookworm; nvd · pypdf · debian · 12
[python3-pypdf2]Affected
Source package: [pypdf2]
Details (2)
- 2.12.1-3+deb12u1 · all · bookworm
  Affected
  nvd · pypdf2 · debian · bookworm; nvd · pypdf2 · debian · 12
- 2.12.1-3+deb12u1 · all · bookworm
  Affected
  nvd · pypdf2 · debian · bookworm; nvd · pypdf2 · debian · 12

[Debian 13 (Trixie)]

[python3-pypdf]Affected
Source package: [pypdf]
Details (2)
- 5.4.0-1 · all · trixie
  Affected
  nvd · pypdf · debian · 13
- 5.4.0-1 · all · trixie
  Affected
  nvd · pypdf · debian · 13

Observed: Oct 23, 2026, 9:33:26 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]