CVE-2026-119205

{
  "etk_id": "ETK-2026-3019",
  "cve_id": "CVE-2026-119205",
  "display_id": "CVE-2026-119205",
  "ghsa_id": "GHSA-mfr5-77xh-9j7h",
  "euvd_id": "EUVD-2026-113377",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Infinite loop in pypdf cyclic dictionary cloning",
  "summary": "pypdf versions before 6.21.4 can enter an infinite loop while cloning or duplicating cyclic dictionary objects. An attacker may cause affected applications to hang if they can make the application process a crafted cyclic dictionary through that operation.",
  "mitigation": "Upgrade pypdf to version 6.21.4 or later. Until upgraded, avoid cloning or duplicating untrusted PDF-derived dictionary objects.",
  "vendor": "py-pdf",
  "product": "pypdf",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 6.21.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 6.21.4"
      ],
      "package_name": "pypi",
      "purl": "pkg:pypi/pypi"
    }
  ],
  "cwes": [
    835
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.6056318,
  "t0_at": "2026-10-29T20:35:33.902000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T20:35:33.902000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T20:35:33.902000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119205"
    }
  }
}