A vulnerability in the function read_until_whitespace within pypdf/_utils.py causes each byte of a stream to be concatenated into a new immutable bytes object one at a time. For a stream that contains a long run of non‑whitespace bytes, the routine performs a quadratic number of concatenations, leading to very high CPU usage and prolonged runtimes. The weakness is categorized as CWE‑407 (Improper Resource Allocation).

The issue affects all versions of py-pdf:pypdf released before 6.15.0. Any application that imports and uses pypdf to process PDF files is potentially impacted.

The vulnerability is scored CVSS 6.9, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted PDF file supplied to an application using pypdf; upon parsing a stream with a long non‑whitespace sequence, the application will experience high CPU load and may become unresponsive. No network‑side or privilege escalation component is described in the information provided.