pypdf contains a flaw that allows an attacker to trigger an infinite loop by cloning a specially crafted cyclic DictionaryObject. The loop consumes CPU resources and can stall the process handling the clone, resulting in denial of service. The weakness is identified as CWE-835 (Infinite Loop).

The vulnerable vendor is py-pdf and product pypdf. All releases prior to version 6.21.4 are affected; the issue was fixed in 6.21.4 and later releases.

The CVSS score of 7.1 classifies this issue as high severity. EPSS data is unavailable, so the current exploitation probability is not quantified; the absence from the KEV catalog suggests no documented exploits yet. The likely attack vector is input-based: an attacker supplies a malicious PDF containing a cyclic dictionary that the application processes, forcing the clone operation and causing the loop. This can be remotely achieved if the application accepts PDFs from untrusted sources, otherwise it may remain a local risk.