CVE-2026-82398: pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time.
Patches This has been fixed in pypdf==6.15.0.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3947.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3947] to mitigate the inefficient handling of non-whitespace inputs in pypdf/_utils.py read_until_whitespace.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions earlier than 6.15.0 are affected when they process attacker-crafted PDF input. The issue is triggered while read_until_whitespace handles a stream containing a long sequence of bytes without whitespace.
What does an attacker need to do to trigger the problem?
An attacker needs to supply a crafted PDF containing a long non-whitespace byte run that reaches the affected parsing function. Processing that input can cause long runtimes because the function appends immutable bytes one byte at a time.
What is the remediation?
Upgrade pypdf to version 6.15.0, which fixes the inefficient handling in read_until_whitespace.