Removing an element from a crafted cyclic PDF tree, such as an outline item, causes the pypdf library to enter an infinite loop and block the process. This results in a denial‑of‑service condition, classified as CWE‑835. The malfunction is confined to the process that invokes the library, but in services that parse untrusted PDFs it can render the entire service unavailable until the offending process is terminated.

Any build of the pypdf library older than version 6.20.1 is affected. The library, distributed under the py‑pdf project, is commonly used by applications that parse, modify, or otherwise process PDF documents.

The flaw carries a CVSS score of 6, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation activity. Based on the description, it is inferred that an attacker would need to deliver a crafted PDF containing a cyclic reference to the target application; depending on the deployment, this could be a remote attack if the PDF is accepted over a network or a local attack if the user can trigger PDF processing. Once triggered, the library will loop indefinitely, consuming CPU and halting progress until the process is killed.