Hi,

The following vulnerabilities were published for pypdf.

CVE-2026-82398[0]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.15.0, an attacker can craft a PDF that causes long runtimes when
| the pypdf/_utils.py function read_until_whitespace reads a stream
| containing a long run of bytes without whitespace. The function
| repeatedly performs immutable bytes concatenation in a one-byte
| loop, causing quadratic processing cost for the long non-whitespace
| input. This issue is fixed in version 6.15.0.


CVE-2026-84310[1]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py
| _get_outline to consume long runtimes and large amounts of memory
| when retrieving document outlines with large numbers of entries or
| deeply nested reused paths because the traversal lacked global
| entry-count and nesting-depth limits. This issue is fixed in version
| 6.16.1.


CVE-2026-84311[2]:
| pypdf is a free and open-source pure-python PDF library. Prior to
| 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py
| PageObject._extract_text and PageObject.extract_xform_text to
| traverse a directed acyclic graph of reused form XObjects in which
| each form invokes a child multiple times, creating exponentially
| many traversal paths and causing long runtimes and large memory
| consumption. This issue is fixed in version 6.16.1.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-82398
https://www.cve.org/CVERecord?id=CVE-2026-82398
[1] https://security-tracker.debian.org/tracker/CVE-2026-84310
https://www.cve.org/CVERecord?id=CVE-2026-84310
[2] https://security-tracker.debian.org/tracker/CVE-2026-84311
https://www.cve.org/CVERecord?id=CVE-2026-84311

Regards,
Salvatore