CVE-2026-82398 in pypdf
Summary
by MITRE • 09/01/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in pypdf versions prior to 6.15.0 represents a significant resource exhaustion risk stemming from inefficient algorithmic complexity within the library's core parsing utilities. Specifically, the flaw resides in the read_until_whitespace function located in the pypdf/_utils.py module. This component is responsible for processing byte streams by reading data until it encounters whitespace characters. In scenarios where an attacker crafts a malicious PDF containing long sequences of non-whitespace bytes, the implementation fails to handle these inputs efficiently. Instead of using optimized string or buffer operations that would result in linear time complexity relative to input size, the function employs immutable bytes concatenation within a loop that processes one byte at a time. Because Python strings and bytes are immutable, each concatenation operation requires allocating new memory and copying all existing data plus the new byte. This results in quadratic processing cost, meaning the execution time grows exponentially with the length of the input stream rather than linearly.
From an operational perspective, this algorithmic inefficiency translates directly into a Denial of Service condition for applications relying on pypdf to parse PDF documents. An attacker can exploit this by uploading or providing a specially crafted PDF file that contains extremely long runs of non-whitespace data in critical streams. When the library attempts to process such a document, the CPU resources are consumed rapidly as the system performs millions of unnecessary memory allocations and copies for relatively small increases in input size. This leads to severe latency spikes, thread blocking, or complete application crashes due to resource exhaustion. The impact is particularly acute in server-side environments where multiple concurrent requests might trigger this behavior simultaneously, potentially overwhelming the host machine's CPU capacity and rendering legitimate services unavailable.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-756: Missing or Incorrect Calculation of Forced Resource Usage. The exploitation technique is consistent with ATT&CK tactic T1496, specifically the subtechnique for Resource Hijacking via computational exhaustion. By forcing the application to perform disproportionate work relative to the input size, an attacker can effectively hijack system resources without needing to exploit memory corruption or execute arbitrary code. This makes it a potent vector for disrupting service availability in any environment that processes untrusted PDF inputs using vulnerable versions of pypdf.
The issue was addressed in version 6.15.0 through optimizations that eliminate the quadratic behavior, likely by replacing the iterative byte concatenation with more efficient buffer handling or string building techniques that operate in linear time. To mitigate this risk immediately for organizations still running older versions, it is imperative to upgrade pypdf to version 6.15.0 or later as soon as possible. For environments where an immediate upgrade is not feasible, implementing input validation and size limits on PDF files before they are processed by the library can serve as a temporary defense-in-depth measure. Additionally, deploying rate limiting and resource quotas at the application gateway level can help mitigate the impact of such attacks by restricting the amount of processing time or memory any single request can consume. Regularly monitoring for updates to third-party dependencies is essential to maintain resilience against algorithmic complexity vulnerabilities that are often overlooked in favor of more traditional injection or execution flaws.