CVE-2026-119205
Received
Received - Intake
Infinite Loop in pypdf Due to Cyclic DictionaryObject Cloning
Vulnerability report for CVE-2026-119205, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: GitHub, Inc.
Description
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
