CVE-2026-82398— pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
Quick assessment
Affected
py-pdf pypdf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pypdf 是一个免费且开源的纯 Python PDF 处理库。在 6.15.0 版本之前，攻击者可以构造一个 PDF 文件，其中包含一段很长的、不含空白字符的字节流。当 pypdf 的 模块中的 函数读取该流时，会进入一个逐字节循环，并在每次迭代中进行不可变字节的拼接操作，导致处理时间随输入长度呈二次方增长（即性能严重下降，可能被用于拒绝服务攻击）。该问题已在 6.15.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1020.001 · Traffic Duplication
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82398
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
Source: CVE Program / CVE List V5
Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82398
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82398
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82398 (1)
Vendor Advisories for CVE-2026-82398 (1)
Other References for CVE-2026-82398 (1)
-
🔗 Release Version 6.15.0, 2026-08-06 · py-pdf/pypdf · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: pypdf
-
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C -
CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline imag -
CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline imag -
CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-r
Same vendor: py-pdf
-
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode stre -
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large C -
CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline imag -
CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline imag -
CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-r
Same weakness: CWE-407
-
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-ti -
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-77831
Algorithmic-complexity denial of service in AshPaperTrail fu -
CVE-2026-81722
nltk PorterStemmer before 3.10.3 Quadratic-time DoS -
CVE-2026-75005
Apache APISIX: Unauthenticated CPU-exhaustion DoS
V. Comments for CVE-2026-82398
No comments yet