CVE-2026-82398: pypdf Library DOS Vulnerability

CVE-2026-82398 Overview

CVE-2026-82398 is an algorithmic complexity vulnerability [CWE-407] in pypdf, a widely used open-source pure-Python PDF library. Versions prior to 6.15.0 contain a flaw in the read_until_whitespace function inside pypdf/_utils.py. An attacker can craft a PDF containing a long run of bytes without whitespace, causing the parser to enter a quadratic-cost loop. The function repeatedly performs immutable bytes concatenation one byte at a time, producing runtimes that scale with the square of the input length. Applications that ingest untrusted PDFs, such as document processing pipelines, mail gateways, or web upload endpoints, may exhaust CPU resources when processing a malicious file.

Critical Impact
A single crafted PDF can trigger sustained CPU exhaustion in server-side pypdf consumers, degrading availability of document-processing services.

Affected Products

pypdf versions prior to 6.15.0
Python applications and services that ingest untrusted PDF input via pypdf
Downstream libraries and pipelines that bundle vulnerable pypdf versions

Discovery Timeline

2026-08-31 - CVE-2026-82398 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82398

Vulnerability Analysis

The defect is a classic algorithmic complexity issue in a stream-parsing helper. read_until_whitespace reads one byte at a time from a stream and appends it to an accumulator until whitespace is reached or a byte cap is hit. The original implementation used an immutable bytes object as the accumulator and performed txt += tok inside the loop.

Each concatenation on an immutable bytes object allocates a new buffer and copies all previously accumulated bytes. For an input of length N without whitespace, this yields O(N²) work and O(N²) memory copies. An attacker who controls a PDF stream can insert a long unbroken token to force worst-case behavior. The impact is availability degradation, consistent with the CVSS vector that reports only availability impact.

Root Cause

The root cause is the use of immutable bytes concatenation inside a tight per-byte loop. Python's bytes type does not support in-place appends, so += produces a new object each iteration. The fix replaces the accumulator with a mutable bytearray, converting the loop to amortized O(N).

Attack Vector

Exploitation requires only that a vulnerable application parse an attacker-supplied PDF. No authentication or user interaction beyond normal document submission is required. Any network-reachable service that accepts PDF uploads and invokes pypdf parsing is a candidate target.

python

 WHITESPACES_AS_REGEXP = b"[" + WHITESPACES_AS_BYTES + b"]"
 
 
-def read_until_whitespace(stream: StreamType, maxchars: Optional[int] = None) -> bytes:
+def read_until_whitespace(stream: StreamType, max_bytes: Optional[int] = None) -> bytes:
     """
     Read non-whitespace characters and return them.
 
-    Stops upon encountering whitespace or when maxchars is reached.
+    Stops upon encountering whitespace or when max_bytes is reached.

     Args:
         stream: The data stream from which was read.
-        maxchars: The maximum number of bytes returned; by default unlimited.
+        max_bytes: The maximum number of bytes returned; by default unlimited.

     Returns:
         The data which was read.

     """
-    txt = b""
+    txt = bytearray()
     while True:
         tok = stream.read(1)
         if tok.isspace() or not tok:
             break
         txt += tok
-        if len(txt) == maxchars:
+        if len(txt) == max_bytes:
             break

Source: pypdf commit 4959848. The patch switches the accumulator from immutable bytes to bytearray, eliminating the quadratic copy cost.

Detection Methods for CVE-2026-82398

Indicators of Compromise

Sustained single-core CPU saturation in Python worker processes handling PDF uploads.
Request timeouts or worker recycling events correlated with specific inbound PDF documents.
PDF objects containing unusually long unbroken byte runs with no whitespace delimiters.

Detection Strategies

Inventory dependencies with pip list or SBOM tooling and flag any pypdf version below 6.15.0.
Enable per-request CPU and wall-clock time budgets on document parsing workers to surface anomalous processing durations.
Log the size and processing duration of every parsed PDF and alert on outliers relative to a baseline.

Monitoring Recommendations

Track process-level CPU time per PDF ingestion job and correlate with source IP and uploader identity.
Monitor queue depth and worker starvation metrics in document-processing services.
Capture and retain suspect PDFs that trigger timeouts for offline analysis.

How to Mitigate CVE-2026-82398

Immediate Actions Required

Upgrade pypdf to version 6.15.0 or later across all environments.
Audit transitive dependencies for vulnerable pypdf pins and rebuild affected container images.
Enforce parsing timeouts and memory limits on worker processes that consume untrusted PDFs.

Patch Information

The fix is available in pypdf release 6.15.0 and was introduced by pull request #3947. See the GitHub Security Advisory GHSA-fc8x-2rww-xw9m for coordinated disclosure details.

Workarounds

Wrap pypdf parsing calls in a subprocess or worker with a strict CPU-time limit (for example, resource.setrlimit(RLIMIT_CPU, ...)).
Reject inbound PDFs above a size threshold appropriate for the application before invoking pypdf.
Rate-limit PDF submissions per client to reduce amplification potential from a single crafted document.

bash

# Upgrade pypdf to the patched release
pip install --upgrade 'pypdf>=6.15.0'

# Verify installed version
python -c "import pypdf; print(pypdf.__version__)"