High severityNVD Advisory· Published Oct 29, 2026

CVE-2026-119205

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.

Patches

Vulnerability mechanics

References

github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044nvd
github.com/py-pdf/pypdf/pull/4288nvd
github.com/py-pdf/pypdf/releases/tag/6.21.4nvd
github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7hnvd

News mentions

No linked articles in our index yet.