Pypdf2: Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream… (CVE-2026-82398)
Description
Pypdf2 versions prior to 6.15.0 contain a vulnerability where an attacker can craft a PDF that causes excessive processing time due to inefficient handling of long runs of non-whitespace bytes in the read_until_whitespace function. This results in a denial of service via resource exhaustion. The issue is fixed in version 6.15.0.
CVSS v3.1
Score 5.3medium
Affected software
pkg:deb/ubuntu/pypdf2?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/pypdf2?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/pypdf2?arch=source&distro=focalpkg:deb/ubuntu/pypdf2?arch=source&distro=jammypkg:deb/ubuntu/pypdf?arch=source&distro=noblepkg:deb/ubuntu/pypdf2?arch=source&distro=noblepkg:deb/ubuntu/pypdf?arch=source&distro=stonkingpkg:deb/ubuntu/pypdf?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pypdf2 library, a pure-Python PDF processing tool, has a performance vulnerability in versions before 6.15.0. The function read_until_whitespace in pypdf/_utils.py inefficiently concatenates bytes one at a time when reading streams with long sequences of bytes without whitespace. This causes a quadratic runtime complexity leading to long processing times and potential denial of service. The vulnerability is addressed by improvements in version 6.15.0.
Potential Impact
An attacker can cause a denial of service by supplying a specially crafted PDF that triggers long runtimes in the vulnerable function, leading to resource exhaustion. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to pypdf2 version 6.15.0 or later, where this issue is fixed. No other mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-82398
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5602cdf04f656661c5e
Added to database: 10/17/2026, 22:23:28 UTC
Last enriched: 10/17/2026, 23:31:44 UTC
Last updated: 10/17/2026, 23:31:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.