A vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that triggers an infinite loop when cloning a DictionaryObject. This flaw has been assigned CVE-2026-119205 and is rated high severity with a CVSS score of 7.1. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.