Live › vulnerability › CVE-2026-119205
pypdf, a pure-Python PDF library, can enter an infinite loop when cloning or duplicating a crafted cyclic dictionary object in a PDF. An attacker who supplies such a file can make the processing code hang, stalling the program that handles it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Any application or script that uses pypdf to clone, duplicate or process PDF files from untrusted sources is exposed to the hang. Systems that only read trusted, internally generated PDFs are unlikely to meet the crafted input. unknown whether a specific deployment path is reachable.
No product ranges from the sources yet.
pip show pypdf and look for anything below 6.21.4.6.21.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-119205")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.