PYSEC-2026-3913 pypdf: Possible infinite loop for TreeObject.insert_child

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. Patches This has been fixed in pypdf==6.16.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

The vulnerability of the TreeObject.insert_child() function in the Python library for working with PDF files, PyPDF, allows a hacker to cause a service failure.

The vulnerability of the TreeObject.insertchild function in the Python library for working with PDF files PyPDF is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-84309

A flaw was found in pypdf. An attacker can craft a malicious PDF document with a cyclic tree structure. When a writing code path attempts to insert a child object, the TreeObject.insertchild function can follow /Next links indefinitely, leading to an infinite loop. This can result in a denial of...

GHSA-JP53-MHQP-8XCG pypdf: Possible infinite loop for TreeObject.insert_child

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. Patches This has been fixed in pypdf==6.16.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop in the insertchild method of TreeObject, whose loop can fail to reach its exit condition. An attacker can hang the...

pypdf: Possible infinite loop for TreeObject.insert_child

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. Patches This has been fixed in pypdf==6.16.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

CVE-2026-84309: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...