Zero Radar
← feed
HighVulnerabilityCVE-2026-119205updated 30 Oct 2026, 23:12 UTC

pypdf PDF library can hang forever on a crafted file

A specially crafted PDF file can make the pypdf Python library get stuck in an endless loop, freezing the program that processes it. Nothing in the material says data is stolen or systems are taken over.

Fixed in pypdf 6.21.4 · out Official, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespypdf 6.21.4 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts PDFFile contains a cyclic dictionary structure
  2. 2Application processes fileCode clones or duplicates the PDF object
  3. 3pypdf traverses cycleVisited-object check misses some source cycles
  4. 4Process hangsInfinite loop consumes the process indefinitely
  5. ResultProcessing hangs, service becomes unavailable

What happened

In pypdf before 6.21.4, cloning or duplicating a crafted, cyclic DictionaryObject can cause an infinite loop, because the clone traversal checks generated destination references instead of the original source references, letting some source cycles bypass the visited-object check.

Why it is dangerous: A malicious PDF can make any service or script that clones or duplicates its contents hang indefinitely, causing denial of service. Anyone processing untrusted PDFs with pypdf is at risk.

Are you affected?

You are affected if you use the pypdf Python package older than 6.21.4 to clone or duplicate DictionaryObject content from PDF files you do not fully trust.

Package / productAffected versionsFixed in
pypdf · pip< 6.21.46.21.4

What to do

  1. Update pypdf to version 6.21.4 or later (pip install --upgrade pypdf)
  2. If you cannot upgrade yet, apply the changes from PR #4288 in the pypdf repository
  3. Set timeouts on PDF processing jobs so a hung file cannot block your service indefinitely

Timeline

  1. 29 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 21:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:12 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:12 UTC
    Fixed version published: pypdf 6.21.4 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119205 · GHSA-mfr5-77xh-9j7h
CVSS
7.1 / 10
Disclosed
29 Oct 2026, 21:17 UTC
On Zero Radar
29 Oct 2026, 21:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:12 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pypdf PDF library can hang forever on a crafted file · Zero Radar