Calling PdfWriter.find_outline_item on a PDF that contains a cyclic outline hierarchy can cause an infinite loop, blocking the process that is attempting the operation. This results in a denial of service, as the process becomes unresponsive and may exhaust system resources. The weakness is characterized as an infinite loop (CWE-835), which does not enable code execution or privilege escalation, but can compromise availability. The likely way an attacker would trigger this is by delivering a crafted PDF to any system that automatically processes PDFs using pypdf. The impact is limited to the application or service handling the PDF, but if critical services depend on this library, availability could be severely disrupted.

The vendor is py-pdf, product pypdf. Versions prior to 6.20.1 are vulnerable. The fix was introduced in release 6.20.1; later releases are not affected.

The CVSS score of 6.0 marks the problem as moderately severe, though the lack of an EPSS score indicates that actual exploitation data is not publicly documented. Because the attack requires a crafted PDF to be processed, the threat is primarily relevant to services that accept or parse PDFs from untrusted sources. No entry in the CISA KEV catalog means no known widespread exploitation, yet the function’s infinite loop can still cause significant downtime if the vulnerable library is in use.