{"id":"CVE-2026-119205","kind":"vulnerability","aliases":["CVE-2026-119205"],"related":[],"title":"pypdf: crafted PDF can hang cloning and duplication, causing denial of service","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.","summary":"pypdf, a pure-Python PDF library, can enter an infinite loop when cloning or duplicating a crafted cyclic dictionary object in a PDF. An attacker who supplies such a file can make the processing code hang, stalling the program that handles it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pypdf","python"],"not_affected_if":["pypdf-not-used","trusted-pdfs-only"],"how_to_check":"- Check the installed pypdf version with `pip show pypdf` and look for anything below `6.21.4`.\n- Search dependency files (requirements.txt, poetry.lock, uv.lock) for pypdf to find where it is pinned.","fix":"- pypdf: upgrade to `6.21.4`","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:41+00:00","updated_at":"2026-10-29T21:28:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T21:28:41Z","model":"claude-haiku-5-5","output":{"fix":"- pypdf: upgrade to `6.21.4`","reach":"unknown","title":"pypdf: crafted PDF can hang cloning and duplication, causing denial of service","impact":"low","summary":"pypdf, a pure-Python PDF library, can enter an infinite loop when cloning or duplicating a crafted cyclic dictionary object in a PDF. An attacker who supplies such a file can make the processing code hang, stalling the program that handles it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypdf"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Processing thread hangs indefinitely, causing denial of service","analyst_note":"","how_to_check":"- Check the installed pypdf version with `pip show pypdf` and look for anything below `6.21.4`.\n- Search dependency files (requirements.txt, poetry.lock, uv.lock) for pypdf to find where it is pinned.","plain_action":"","needs_analyst":false,"not_affected_if":["pypdf-not-used","trusted-pdfs-only"],"who_is_affected":"Any application or script that uses pypdf to clone, duplicate or process PDF files from untrusted sources is exposed to the hang. Systems that only read trusted, internally generated PDFs are unlikely to meet the crafted input. unknown whether a specific deployment path is reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4130,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119205':15A,18A '-2026':14A,17A '6.21.4':79C,123C 'allow':106C 'attack':47B 'caus':9A 'check':96C,116C 'clone':6A,35B,87C,94C 'code':57B 'craft':2A,39B,91C 'cve':13A,16A 'cycl':109C 'cyclic':40B,92C 'denial':10A 'destin':98C 'dictionari':41B 'dictionaryobject':93C 'duplic':8A,37B,89C 'enter':30B,82C 'evad':111C 'file':52B 'fix':120C 'free':67C 'generat':97C 'handl':63B 'hang':5A,58B 'infinit':32B,84C 'issu':118C 'librari':28B,76C 'loop':33B,85C 'make':54B 'object':42B,115C 'open':70C 'open-sourc':69C 'origin':103C 'packag':19B 'pdf':3A,27B,45B,75C 'prior':77C 'process':56B 'program':61B 'pure':25B,73C 'pure-python':24B,72C 'pypdf':1A,20B,22B,64C,80C 'python':21B,26B,74C 'rather':100C 'refer':99C,105C 'servic':12A 'sourc':71C,104C,108C 'stall':59B 'suppli':49B 'travers':95C 'version':122C 'visit':114C 'visited-object':113C","nicknames":[],"mitigations":[],"who_affected":"Any application or script that uses pypdf to clone, duplicate or process PDF files from untrusted sources is exposed to the hang. Systems that only read trusted, internally generated PDFs are unlikely to meet the crafted input. unknown whether a specific deployment path is reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119205","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}