What’s Vulnerable › Vulnerabilities

CVE-2026-119205: pypdf: Possible infinite loop when cloning dictionaries

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-30
• Weakness: CWE-835

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.

Affected products

• py-pdf pypdf: before 6.21.4

References

• https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044
• https://github.com/py-pdf/pypdf/pull/4288
• https://github.com/py-pdf/pypdf/releases/tag/6.21.4
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h

Get alerted when CVE-2026-119205 or the next vulnerability affects your stack