{"id":"CVE-2023-36810","aliases":["DEBIAN-CVE-2023-36810","DLA-3497-1","EUVD-2023-1837","GHSA-jrm6-h9cq-8gqw","MGASA-2023-0254","PYSEC-2026-1837","UBUNTU-CVE-2023-36810","USN-6280-1"],"status":"published","title":"Quadratic runtime with malformed PDF missing xref marker in pypdf","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0063,"percentile":0.5055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2023-06-30T18:43:12Z","modified":"2026-11-04T02:46:09Z","fixes":[{"ecosystem":"PyPI","package":"pypdf2","fixed_in":["1.27.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pypdf2","fixed_in":["1.27.9-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"pypdf2","fixed_in":["1.26.0-2+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-pypdf2","fixed_in":["1.27.9-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-pypdf2","fixed_in":["1.27.9-1.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","fixed_in":["1.25.1-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","fixed_in":["1.26.0-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","fixed_in":["1.26.0-3ubuntu1.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","fixed_in":["1.26.0-4ubuntu0.22.04.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.27.8"},{"fixed":"1.27.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2+deb10u2"}]}],"versions":["1.26.0-2","1.26.0-2+deb10u1"]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9"}]}],"versions":["1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.25.1","1.26.0","1.27.0","1.27.1","1.27.2","1.27.3","1.27.4","1.27.5","1.27.6","1.27.7","1.27.8"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"python-pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9-1.mga9"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.9"}]}],"versions":["1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.25.1","1.26.0","1.27.0","1.27.1","1.27.2","1.27.3","1.27.4","1.27.5","1.27.6","1.27.7","1.27.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1ubuntu0.1~esm2"}]}],"versions":["1.23+git20141008-1","1.25.1-1","1.25.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2ubuntu0.1~esm2"}]}],"versions":["1.26.0-2","1.26.0-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-3ubuntu1.20.04.2"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1","1.26.0-3ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-4ubuntu0.22.04.2"}]}],"versions":["1.26.0-4","1.26.0-4ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1ubuntu0.1~esm2"}]}],"versions":["1.23+git20141008-1","1.25.1-1","1.25.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2ubuntu0.1~esm2"}]}],"versions":["1.26.0-2","1.26.0-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-3ubuntu1.20.04.2"}]}],"versions":["1.26.0-2","1.26.0-3ubuntu1","1.26.0-3ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypdf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-4ubuntu0.22.04.2"}]}],"versions":["1.26.0-4","1.26.0-4ubuntu0.22.04.1"]}],"products":[{"vendor":"py-pdf","product":"pypdf"}],"references":[{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/py-pdf/pypdf/issues/582","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/py-pdf/pypdf/pull/808","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36810","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-jrm6-h9cq-8gqw","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36810.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-36810","tags":["advisory"]},{"url":"https://github.com/py-pdf/pypdf","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0254.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32115","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3497","tags":["web"]},{"url":"https://pypi.org/project/pypdf2","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-36810","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6280-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36810","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-36810","title":"Quadratic runtime with malformed PDF missing xref marker in pypdf","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T18:43:12.801Z","modified":"2025-02-13T16:56:24.866Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-1837","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T18:43:12Z","modified":"2025-02-13T16:56:24Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:50.021705Z"}],"ghsa":[{"id":"GHSA-jrm6-h9cq-8gqw","title":"PyPDF2 quadratic runtime with malformed PDF missing xref marker","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.\nThis quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.\n\n### Patches\nhttps://github.com/py-pdf/pypdf/pull/808\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)\n* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)","status":"published","published":"2023-06-30T22:17:52Z","modified":"2023-11-06T05:04:46Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-36810","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T19:15:09.357Z","modified":"2026-11-02T16:06:04.477Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"CVE-2023-36810","title":"Quadratic runtime with malformed PDF missing xref marker in pypdf","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T18:43:12.801Z","modified":"2026-11-04T02:46:09.939301439Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-04T02:54:00.554175Z"},{"id":"DEBIAN-CVE-2023-36810","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T19:15:09.357Z","modified":"2026-11-03T09:47:28.713031626Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-jrm6-h9cq-8gqw","title":"PyPDF2 quadratic runtime with malformed PDF missing xref marker","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.\nThis quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.\n\n### Patches\nhttps://github.com/py-pdf/pypdf/pull/808\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)\n* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)","status":"published","published":"2023-06-30T22:17:52Z","modified":"2026-07-07T17:57:15.295956748Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"PYSEC-2026-1837","title":"PyPDF2 quadratic runtime with malformed PDF missing xref marker","description":"### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.\nThis quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.\n\n### Patches\nhttps://github.com/py-pdf/pypdf/pull/808\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)\n* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)","status":"published","published":"2026-07-07T11:45:19.7155Z","modified":"2026-07-07T17:46:59.5240421Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2023-36810","description":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-06-30T19:15:00Z","modified":"2026-02-04T04:29:33.906906Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"DLA-3497-1","title":"pypdf2 - security update","status":"published","published":"2023-07-14T00:00:00Z","modified":"2026-03-09T01:22:23.554845Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0254","title":"Updated python-pypdf2 packages fix security vulnerability","description":"It was discovered that python-pypdf2 contained a vulnerability whereby an\nattacker can craft a PDF which leads to unexpected long runtime. \n(CVE-2023-36810).\n","status":"published","published":"2023-09-11T13:07:54Z","modified":"2026-04-16T04:43:42.484867342Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-6280-1","title":"pypdf2 vulnerability","description":"It was discovered that PyPDF2 incorrectly handled PDF files with certain\nmarkers. If a user or automated system were tricked into processing a\nspecially crafted file, an attacker could possibly use this issue to\nconsume system resources, resulting in a denial of service.\n","status":"published","published":"2023-08-10T00:19:56Z","modified":"2026-06-25T13:32:13.893914814Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}