GHSA-mfr5-77xh-9j7h CVE-2026-119205

pypdf has possible infinite loop when cloning dictionaries

High PyPI

Severity: 7.1 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.30%; Chance of exploitation in the next 30 days. Higher than 23.19% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Fix: 6.21.4; Upgrade pypdf to this version or later

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject.

Patches

This has been fixed in pypdf==6.21.4.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4288.

Affected versions

PyPI

Package	Vulnerable	Fixed in
pypdf	`< 6.21.4`	`6.21.4`
pypdf	`< 6.21.4`	`6.21.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pypdf PyPI → `6.21.4`

pip

pip install --upgrade "pypdf>=6.21.4"

poetry

poetry add "pypdf>=6.21.4"

uv

uv add "pypdf>=6.21.4"

Severity breakdown

CVSS 4.0 7.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Advisories

Fixes and patches

Packages

github.com/py-pdf/pypdf

Timeline

Oct 30, 2026 Published
Oct 30, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search	High	Also affects pypdf
GHSA-cggf-277g-3q54 pypdf has possible large memory usage when parsing page tree	High	Also affects pypdf
GHSA-42gh-23hr-vphw pypdf has possible long runtimes when retrieving page labels	High	Also affects pypdf
GHSA-4vqv-7265-gm2w pypdf has possible large memory usage for exceptions in strict mode	High	Also affects pypdf
GHSA-62m5-6wh8-28x7 pypdf has possible long runtimes/large memory usage for encrypted PDF files	High	Also affects pypdf
GHSA-x3rh-gjgm-fmqc pypdf has possible large memory usage when parsing cross-reference streams	High	Also affects pypdf
GHSA-jr96-gvgh-j3r4 pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)	High	Also affects pypdf
GHSA-gmh7-3g9r-mjh5 pypdf: Possible long runtimes for large xref table header limits	High	Also affects pypdf

Credits: KeenSecurityLab, smaeljaish771

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor