CVE-2026-82398

Received Received - Intake

Denial of Service in pypdf via Quadratic Bytes Concatenation

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82398

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is in the pypdf library, a Python PDF processing tool. It involves a flaw in the read_until_whitespace function in pypdf/_utils.py. An attacker can create a malicious PDF with a long sequence of non-whitespace bytes, causing the function to repeatedly concatenate bytes inefficiently. This leads to quadratic processing time, making the system slow or unresponsive.

Detection Guidance

This vulnerability can be detected by checking the version of pypdf installed on your system. Run the command 'pip show pypdf' to check the version. If the version is below 6.15.0, the system is vulnerable.

Impact Analysis

If you use pypdf versions before 6.15.0, an attacker could exploit this to cause denial-of-service by sending a specially crafted PDF. This could slow down or crash applications relying on pypdf, disrupting normal operations.

Compliance Impact

This vulnerability causes denial-of-service conditions due to excessive processing time, which may impact availability of systems handling PDF processing. For GDPR, this could affect data availability rights under Article 12-17. For HIPAA, it may disrupt access to protected health information, potentially violating Security Rule requirements for access controls and integrity.

Mitigation Strategies

Upgrade pypdf to version 6.15.0 or later using the command 'pip install --upgrade pypdf'. This version contains the fix for the quadratic processing cost issue.

Hi! I’m here to help you understand CVE-2026-82398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70