pypdf has possible infinite loop when cloning dictionaries

ALTO 7.1CVE-2026-119205 · GHSA-mfr5-77xh-9j7h · Published 29/10/2026 · updated 30/10/2026

Em resumo

CVE-2026-119205 é uma vulnerabilidade ALTO (CVSS 7.1) que afeta pypdf.
Chance de exploração nos próximos 30 dias (EPSS): 0.30%, maior que 23.2% das vulnerabilidades.
Correção: atualize para 6.21.4 ou posterior.

Package	Affected versions	Patched versions
pypdf PyPI	`< 6.21.4`	`6.21.4`

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject.

Patches

This has been fixed in pypdf==6.21.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4288.

NVD description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.