CVE-2023-36810
Quadratic runtime with malformed PDF missing xref marker in pypdf
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Quadratic runtime with malformed PDF missing xref marker in pypdf
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-36810- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2023-1837
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-1837- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrm6-h9cq-8gqw
PyPDF2 quadratic runtime with malformed PDF missing xref marker
Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
Patches
https://github.com/py-pdf/pypdf/pull/808
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
- Record
GHSA-jrm6-h9cq-8gqw- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
NVD
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-36810- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
OSV
Quadratic runtime with malformed PDF missing xref marker in pypdf
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-36810- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2023-36810
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2023-36810- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-jrm6-h9cq-8gqw
PyPDF2 quadratic runtime with malformed PDF missing xref marker
Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
Patches
https://github.com/py-pdf/pypdf/pull/808
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
- Record
GHSA-jrm6-h9cq-8gqw- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
OSVPYSEC-2026-1837
PyPDF2 quadratic runtime with malformed PDF missing xref marker
Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
Patches
https://github.com/py-pdf/pypdf/pull/808
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
- Record
PYSEC-2026-1837- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-36810
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2023-36810- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0254 No score
Updated python-pypdf2 packages fix security vulnerability
It was discovered that python-pypdf2 contained a vulnerability whereby an attacker can craft a PDF which leads to unexpected long runtime. (CVE-2023-36810).
- Record
MGASA-2023-0254- Updated
- 2026-11-02
OSVUSN-6280-1 No score
pypdf2 vulnerability
It was discovered that PyPDF2 incorrectly handled PDF files with certain markers. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to consume system resources, resulting in a denial of service.
- Record
USN-6280-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pypdf2PyPI |
through 1.27.8 | 1.27.9 |
pypdf2Debian:12 |
before 1.27.9-1 | 1.27.9-1 |
pypdf2Debian:10 |
before 1.26.0-2+deb10u2, plus listed versions 1.26.0-21.26.0-2+deb10u1 |
1.26.0-2+deb10u2 |
pypdf2PyPI |
before 1.27.9, plus listed versions 1.151.161.171.181.19 Show 17 moreShow less1.201.211.221.231.241.251.25.11.26.01.27.01.27.11.27.21.27.31.27.41.27.51.27.61.27.71.27.8 |
1.27.9 |
python-pypdf2Mageia:8 |
before 1.27.9-1.mga8 | 1.27.9-1.mga8 |
python-pypdf2Mageia:9 |
before 1.27.9-1.mga9 | 1.27.9-1.mga9 |
pypdf2Ubuntu:Pro:16.04:LTS |
before 1.25.1-1ubuntu0.1~esm2, plus listed versions 1.23+git20141008-11.25.1-11.25.1-1ubuntu0.1~esm1 |
1.25.1-1ubuntu0.1~esm2 |
pypdf2Ubuntu:Pro:18.04:LTS |
before 1.26.0-2ubuntu0.1~esm2, plus listed versions 1.26.0-21.26.0-2ubuntu0.1~esm1 |
1.26.0-2ubuntu0.1~esm2 |
pypdf2Ubuntu:20.04:LTS |
before 1.26.0-3ubuntu1.20.04.2, plus listed versions 1.26.0-21.26.0-3ubuntu11.26.0-3ubuntu1.20.04.1 |
1.26.0-3ubuntu1.20.04.2 |
pypdf2Ubuntu:22.04:LTS |
before 1.26.0-4ubuntu0.22.04.2, plus listed versions 1.26.0-41.26.0-4ubuntu0.22.04.1 |
1.26.0-4ubuntu0.22.04.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36810 is a medium vulnerability (CVSS 6.2) in Py-pdf Pypdf, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in pypdf2 1.27.9.
References
github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
lists.debian.org/debian-lts-announce/2023/07/msg00019.html
nvd.nist.gov/vuln/detail/CVE-2023-36810
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2023-36810
advisories.mageia.org/MGASA-2023-0254.html
bugs.mageia.org/show_bug.cgi?id=32115
debian.org/lts/security/2023/dla-3497
pypi.org/project/pypdf2
ubuntu.com/security/CVE-2023-36810
cve.org/CVERecord?id=CVE-2023-36810