The vulnerability arises from the lack of global entry‑count and nesting‑depth limits in the _get_outline routine of pypdf/_doc_common.py. An attacker can craft a PDF file with an extreme number or depth of outline entries. When the library processes such a PDF, it enters a long traversal loop that consumes excessive CPU time and allocates large amounts of memory, potentially exhausting system resources. The flaw is a classic case of resource exhaustion (CWE‑405, CWE‑770, CWE‑834) that can lead to denial of service for applications that use pypdf.

Affected instances are installations of the py‑pdf pypdf library running any version earlier than 6.16.1. The fix is incorporated in release 6.16.1, so all versions below that threshold are vulnerable when processing PDFs that contain very large or deeply nested outlines.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying limited known exploitation. An attacker would need to supply a malicious PDF to an application that imports or processes the file with pypdf. While the flaw causes high resource consumption, it does not expose code execution or data leakage. Nonetheless, it can degrade availability of legitimate PDF processing services, especially when exposed to untrusted input.