CVE-2026-82398 — pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whit…
Published: 2026-08-31 · CVSS: 6.9 · CVSS 4.0
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7