CVE-2026-82398: pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.15.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using pypdf versions earlier than 6.15.0 are affected when they process attacker-crafted PDF input. The issue is triggered while read_until_whitespace handles a stream containing a long sequence of bytes without whitespace.
What does an attacker need to do to trigger the problem?
An attacker needs to supply a crafted PDF containing a long non-whitespace byte run that reaches the affected parsing function. Processing that input can cause long runtimes because the function appends immutable bytes one byte at a time.
What is the remediation?
Upgrade pypdf to version 6.15.0, which fixes the inefficient handling in read_until_whitespace.