Listen to this Post
pypdf is a free and open-source pure-python PDF library. Prior to version 6.15.0, the library contains an algorithmic complexity vulnerability in the `read_until_whitespace` function located in pypdf/_utils.py. This function is responsible for reading byte streams until a whitespace character is encountered.
An attacker can exploit this vulnerability by crafting a malicious PDF that contains an extremely long run of bytes without any whitespace. When the vulnerable `read_until_whitespace` function processes such a stream, it enters a one-byte loop that performs immutable bytes concatenation (txt += tok). Because Python bytes objects are immutable, each concatenation operation allocates new memory and copies all existing data plus the new byte. This results in quadratic processing cost (O(n²)) relative to the length of the non‑whitespace input.
The execution time grows exponentially with the input size rather than linearly. For a moderately large stream, the CPU is consumed rapidly as the system performs millions of unnecessary memory allocations and copies. This leads to severe latency spikes, thread blocking, or complete application crashes due to resource exhaustion. The impact is particularly acute in server‑side environments where multiple concurrent requests might trigger this behavior simultaneously, potentially overwhelming the host machine’s CPU capacity. The vulnerability aligns with CWE‑407 (Inefficient Algorithmic Complexity) and CWE‑400 (Uncontrolled Resource Consumption), and the exploitation technique is consistent with the ATT&CK tactic for Resource Hijacking via computational exhaustion (T1496).
The issue has been fixed in pypdf version 6.15.0 by replacing the iterative byte concatenation with a `bytearray` accumulator, which is then converted to `bytes` at return, eliminating the quadratic complexity. For users who cannot upgrade immediately, applying the changes from pull request 3947 serves as a workaround.
DailyCVE Form:
Platform: pypdf
Version: < 6.15.0
Vulnerability: Algorithmic Complexity
Severity: MEDIUM (CVSS 6.9)
date: 2026-08-31
Prediction: Already Patched (6.15.0)
What Undercode Say:
Check installed pypdf version pip show pypdf | grep Version Upgrade to patched version pip install --upgrade pypdf==6.15.0 Verify upgrade python -c "import pypdf; print(pypdf.<strong>version</strong>)"
Vulnerable code pattern (pypdf/_utils.py before 6.15.0) def read_until_whitespace(stream, maxbytes=None): txt = b"" while True: tok = stream.read(1) if tok.isspace() or tok == b"": break txt += tok Immutable concatenation → O(n²) return txt
Patched code pattern (pypdf 6.15.0+) def read_until_whitespace(stream, maxbytes=None): txt = bytearray() Mutable buffer while True: tok = stream.read(1) if tok.isspace() or tok == b"": break txt.extend(tok) O(1) amortized return bytes(txt)
Exploit (Educational Purposes!):
Concept of malicious PDF construction Create a stream object with a long non‑whitespace sequence malicious_stream = b"BT\n" + b"X" 1000000 + b"\nET" 1M bytes without whitespace When parsed by vulnerable pypdf, read_until_whitespace will: - Read byte by byte - Perform txt += tok for each byte - Result in ~1e12 copy operations (quadratic cost) - Cause extreme CPU consumption and denial of service
Protection:
- Upgrade to pypdf version 6.15.0 or later immediately.
- If upgrade is not feasible, apply the changes from PR 3947 manually.
- Implement input validation and size limits on PDF files before processing.
- Deploy rate limiting and resource quotas at the application gateway level.
- Regularly monitor for updates to third‑party dependencies.
Impact:
An attacker can craft a malicious PDF that, when parsed by a vulnerable version of pypdf, causes long runtimes and excessive CPU consumption. This leads to a Denial of Service (DoS) condition where the application becomes unresponsive or crashes. The vulnerability requires no privileges, no user interaction, and can be exploited remotely over the network. The CVSS v4.0 base score is 6.9 (MEDIUM). The flaw affects all pypdf versions prior to 6.15.0 and has been addressed in the 6.15.0 release.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
