diff --git a/pdfbox/src/main/java/org/apache/pdfbox/pdfwriter/COSWriter.java b/pdfbox/src/main/java/org/apache/pdfbox/pdfwriter/COSWriter.java
index 799da34e85a..6f560ce59c2 100644
--- a/pdfbox/src/main/java/org/apache/pdfbox/pdfwriter/COSWriter.java
+++ b/pdfbox/src/main/java/org/apache/pdfbox/pdfwriter/COSWriter.java
@@ -636,9 +636,14 @@ private boolean isNeedToBeUpdated(COSBase base)
      */
     public void doWriteObject( COSBase obj ) throws IOException
     {
-            writtenObjects.add( obj );
             // find the physical reference
-            currentObjectKey = getObjectKey( obj );
+            COSObjectKey currentObj =  getObjectKey( obj );
+            if ( currentObj == null )
+            {
+                return;
+            }
+            currentObjectKey = currentObj;
+            writtenObjects.add( obj );
             doWriteObject(currentObjectKey, obj);
     }
 
@@ -1084,10 +1089,17 @@ private COSObjectKey getObjectKey( COSBase obj )
                 return key;
             }
         }
+        // check is null avoids objectKeys.computeIfAbsent NPE
+        if ( actual == null )
+        {
+            return null;
+        }
         else
         {
             actual = obj;
         }
+        // PDFBOX-4540: because objectKeys is accessible from outside, it is possible
+        // that a COSObject obj is already in the objectKeys map.
         COSObjectKey actualKey = objectKeys.computeIfAbsent(actual,
                 k -> new COSObjectKey(++number, 0));
         // check if the returned key and the origin key of the given object are the same
@@ -1382,6 +1394,10 @@ public void visitFromNull(COSNull obj) throws IOException
     public void writeReference(COSBase obj) throws IOException
     {
             COSObjectKey key = getObjectKey(obj);
+            if ( key == null )
+            {
+                return;
+            }
             getStandardOutput().write(String.valueOf(key.getNumber()).getBytes(StandardCharsets.ISO_8859_1));
             getStandardOutput().write(SPACE);
             getStandardOutput().write(String.valueOf(key.getGeneration()).getBytes(StandardCharsets.ISO_8859_1));