Executive brief
pypdf is a popular Python library used to read, parse, and manipulate PDF files. A flaw in how the library processes PDF content without whitespace characters can cause it to consume excessive CPU resources and runtime, potentially freezing or slowing down applications that process untrusted PDFs. An attacker can craft a specially designed PDF file to trigger this behavior, leading to denial of service against services that parse PDFs.
Technical details
This vulnerability is a ReDoS-like algorithmic complexity issue (CWE-407) in the read_until_whitespace function. The root cause is inefficient handling of inputs without whitespace, likely due to character-by-character scanning or repeated backtracking without proper optimization. An attacker can craft a PDF with extended sequences of non-whitespace characters to trigger the worst-case computational path, causing excessive CPU usage and long processing times. The vulnerability requires the application to parse the malicious PDF (no authentication or special privileges needed), and the attack vector is via network/file upload. The fix was released in pypdf 6.15.0; workarounds involve applying the changes from PR #3947 if upgrading is not immediately possible.
Affected products
- py-pdf pypdf < 6.15.0
Timeline
- 2026-08-06: disclosed: Published by GitHub Advisory Database
- 2026-08-31: advisory: Published by National Vulnerability Database
- 2026-08-06: patched: Fix released in pypdf 6.15.0