CVE-2026-119205 in pypdf
Summary
by MITRE • 10/29/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within the pypdf library represents a significant logic flaw in how object graph traversals are managed during document cloning operations. As an open-source Python library designed for parsing and manipulating PDF files, pypdf is frequently utilized by developers to automate document processing tasks such as merging, splitting, or modifying existing PDF structures. The core issue arises from the implementation of cycle detection mechanisms intended to prevent infinite recursion when handling complex object references within a PDF file. In versions prior to 6.21.4, the cloning logic failed to correctly track visited objects because it evaluated generated destination references rather than preserving and checking against the original source references. This discrepancy allows crafted cyclic DictionaryObjects to bypass the standard visited-object checks that are critical for maintaining stack integrity during deep traversal operations.
From a technical perspective, PDF files utilize an object-based structure where various elements such as pages, fonts, and annotations reference one another through indirect objects. When pypdf attempts to clone or duplicate these structures, it must traverse this graph of references. The flaw lies in the fact that when new objects are instantiated during the cloning process, they receive new identifiers or memory addresses. The vulnerability occurs because the algorithm checks if a destination object has been visited rather than verifying whether the source object being processed was already encountered earlier in the traversal path. Consequently, an attacker can construct a malicious PDF containing circular references among DictionaryObjects that appear distinct to the flawed check but form a true cycle in the original document structure. This allows the cloning routine to enter an infinite loop as it repeatedly processes these objects without ever recognizing they have been seen before.
The operational impact of this vulnerability is primarily centered on resource exhaustion and denial of service conditions for applications relying on pypdf for untrusted input processing. An attacker who can induce a victim application to process a specially crafted PDF file containing such cyclic structures can cause the consuming system's CPU usage to spike indefinitely while memory consumption grows as objects are repeatedly instantiated or processed in an endless loop. This effectively renders the service unavailable, disrupting workflows that depend on automated document handling. While this vulnerability does not directly lead to remote code execution or data exfiltration due to its nature as a logic error leading to hang conditions rather than buffer overflows or injection flaws, it poses a severe risk to the availability and reliability of any system integrating pypdf for processing user-uploaded documents.
This issue aligns with CWE-835, which describes loop issues involving infinite loops that can lead to denial of service scenarios. Furthermore, in the context of adversarial tactics, this vulnerability facilitates resource exhaustion attacks categorized under MITRE ATT&CK technique T1496, specifically related to Resource Hijacking where an attacker consumes computational resources to degrade system performance or availability. The root cause is a failure in state management during recursive traversal, highlighting the importance of maintaining consistent identity checks across object transformations in complex data structures.
To mitigate this vulnerability, organizations and developers must immediately upgrade pypdf to version 6.21.4 or later, where the cloning logic has been corrected to properly track original source references during cycle detection. For systems that cannot be updated instantly due to dependency constraints, implementing input validation layers at the application boundary is recommended. This includes restricting file uploads from untrusted sources and employing sandboxing techniques such as process isolation or resource limits like CPU time quotas and memory caps on processes handling PDF parsing. Additionally, integrating timeout mechanisms for long-running operations can help detect and terminate hung threads before they consume excessive system resources. Regular security audits of third-party library usage are essential to ensure that similar logic flaws in other dependencies do not introduce comparable risks into the software supply chain.