Denial of Service Vulnerability in pypdf PDF Library by PyPDF

CVE-2026-82398

What is CVE-2026-82398?

The pypdf library, a pure-Python PDF handling solution, is susceptible to Denial of Service attacks due to the inefficient handling of byte streams without whitespace. Attackers can exploit this vulnerability by crafting a malicious PDF that triggers a performance bottleneck when the read_until_whitespace function attempts to process long sequences of byte data. In prior versions, this could lead to excessive runtimes and resource exhaustion, as the function repetitively concatenates immutable bytes in a loop. The issue has been mitigated in version 6.15.0.

References