A flaw was found in QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a denial of service via a crafted PDF file.
Created qpdf tracking bugs for this issue:
Affects: epel-6 [bug 1646390]
Affects: fedora-all [bug 1646391]
I failed to reproduce this behavior during my testing. However, the real problem here seems to be the use of an arbitrary limit. Finding such limits is always a balancing act.
If you run into this problem in a real world scenario, please comment and we'll investigate and possibly adjust the limit.