DEBIAN-CVE-2026-119205: High severity debian/pypdf vulnerability

Published Oct 29, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.

Affected Software

4 affected components

debian/pypdf*

debian/pypdf2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4

Event History

Oct 29, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger the issue?

An attacker needs to provide a crafted PDF containing a cyclic DictionaryObject, and the application must clone or duplicate that object using a pypdf version prior to 6.21.4. User interaction is required for the vulnerable application to process the attacker-controlled file.

What is the practical impact of successful exploitation?

Processing the crafted cyclic object can cause pypdf to enter an infinite loop. This can make the affected application unavailable while it is handling the malicious PDF.

Which packages are identified as affected?

The affected software entries are debian/pypdf and debian/pypdf2. The issue is fixed in pypdf version 6.21.4.

DEBIAN-CVE-2026-119205: High severity debian/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the practical impact of successful exploitation?

Which packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the practical impact of successful exploitation?

Which packages are identified as affected?