CVE-2026-119205 py-pdf CVE debrief

Who should care

Users of the pypdf library, especially those processing PDF files, should be aware of this vulnerability and take steps to upgrade or apply workarounds. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation. Users should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-119205 is a vulnerability in the pypdf library that can lead to an infinite loop when cloning dictionaries. Users should upgrade to version 6.21.4 or apply the changes from PR #4288 to prevent potential issues.

• Potential denial of service due to infinite loop
• Possible impact on system performance and stability

Technical summary

The pypdf library is vulnerable to an infinite loop when cloning dictionaries. This requires duplicating a DictionaryObject. The issue has been fixed in pypdf version 6.21.4. The vulnerability can cause a denial of service due to the infinite loop. Users should upgrade to this version or apply the changes from PR #4288 to prevent potential issues. The vulnerability was publicly disclosed on 2026-10-30T23:12:20.000Z. Affected users should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Upgrade to pypdf version 6.21.4 or apply the changes from PR #4288 to prevent potential infinite loops when processing PDF files.

Recommended defensive actions

• Upgrade to pypdf version 6.21.4
• Apply the changes from PR #4288 as a workaround
• Review and update affected systems using pypdf
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by an infinite loop when cloning dictionaries in the pypdf library. This requires duplicating a DictionaryObject. The issue has been fixed in pypdf version 6.21.4. Evidence of the vulnerability is limited to the information provided in the CVE record and the source item. Defenders should verify the affected scope and severity based on the official advisory and CVE record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.