GHSA-mfr5-77xh-9j7h: pypdf has possible infinite loop when cloning dictionaries

Q: Which deployments are realistically exposed to this issue?

Deployments using pypdf versions before 6.21.4 are affected when they clone or duplicate DictionaryObject instances from attacker-crafted PDFs. The impact is an infinite loop, which can make the processing task unavailable.

Q: What must an attacker provide or trigger to exploit this?

An attacker needs to supply a PDF containing a crafted cyclic DictionaryObject and cause the application to clone or duplicate that dictionary. No attacker privileges are required, but exploitation requires user or application processing of the malicious PDF.

Q: Are default pypdf installations affected?

The issue is not triggered merely by loading pypdf or opening any PDF. It requires the application to perform cloning or duplication of the crafted DictionaryObject, so exposure depends on the application's PDF-processing workflow.

Q: What can be done if upgrading is not immediately possible?

Apply the changes from PR #4288 as a workaround. Upgrading to pypdf 6.21.4 is the documented fix.

Published Oct 29, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject.

Patches

This has been fixed in pypdf==6.21.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4288.

Other sources

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.

— OSV

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.4

6.21.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.4

Event History

Oct 29, 2026

CVE Published

via OSV·08:35 PM

Data Sourced

via OSV·08:35 PM

DescriptionSeverityWeakness

Oct 30, 2026

Advisory Published

via GitHub·11:12 PM

Data Sourced

via GitHub·11:12 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·11:12 PM

Affected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments using pypdf versions before 6.21.4 are affected when they clone or duplicate DictionaryObject instances from attacker-crafted PDFs. The impact is an infinite loop, which can make the processing task unavailable.

What must an attacker provide or trigger to exploit this?

An attacker needs to supply a PDF containing a crafted cyclic DictionaryObject and cause the application to clone or duplicate that dictionary. No attacker privileges are required, but exploitation requires user or application processing of the malicious PDF.

Are default pypdf installations affected?

The issue is not triggered merely by loading pypdf or opening any PDF. It requires the application to perform cloning or duplication of the crafted DictionaryObject, so exposure depends on the application's PDF-processing workflow.

What can be done if upgrading is not immediately possible?

Apply the changes from PR #4288 as a workaround. Upgrading to pypdf 6.21.4 is the documented fix.

GHSA-mfr5-77xh-9j7h: pypdf has possible infinite loop when cloning dictionaries

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What must an attacker provide or trigger to exploit this?

Are default pypdf installations affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What must an attacker provide or trigger to exploit this?

Are default pypdf installations affected?

What can be done if upgrading is not immediately possible?