CVE-2026-84311

3.3 Faible

Publiée le 01/09/2026 à 23:18 · Modifiée le 05/10/2026 à 19:42 · Analysée par le NVD · Source : security-advisories@github.com

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	4.8 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	3.3 Faible	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-834

Références

https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942 Patch
https://github.com/py-pdf/pypdf/pull/3966 Patch
https://github.com/py-pdf/pypdf/releases/tag/6.16.1 Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2 PatchVendor Advisory

CVE-2026-84311

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs