CVE-2026-119205: pypdf has possible infinite loop when cloning dictionaries
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject.
Patches
This has been fixed in pypdf==6.21.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4288.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.4 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.4
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must provide a crafted PDF containing a cyclic DictionaryObject, and the application must clone or duplicate that dictionary. The issue can then cause pypdf to enter an infinite loop.
Are applications using pypdf exposed by default?
Exposure depends on whether the application clones or duplicates DictionaryObject instances while processing attacker-controlled PDFs. The available information does not state that ordinary PDF parsing alone triggers the loop.
What versions contain the fix?
The issue is fixed in pypdf 6.21.4. Versions prior to 6.21.4 are affected.
What can be done if upgrading is not immediately possible?
Consider applying the changes from PR #4288. Until remediation is in place, avoid cloning or duplicating DictionaryObject data from untrusted PDFs where possible.