CVE-2023-36810

Quadratic runtime with malformed PDF missing xref marker in pypdf

At a glance

Severity: MEDIUM 6.2
EPSS: EPSS 0.63 % · percentile 50 (2026-10-27)
State: PUBLISHED
Published: 2023-06-30
Updated: 2025-02-13
Assigner: GitHub_M
NVD status: Modified

Description

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M
CVSS 3.1	MEDIUM 6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-407

Advisories

GHSA-jrm6-h9cq-8gqw — PyPDF2 quadratic runtime with malformed PDF missing xref marker
PYSEC-2026-1837 — PyPDF2 quadratic runtime with malformed PDF missing xref marker

European references

ENISA EUVD · EUVD-2023-1837
GCVE · GCVE-0-2023-36810

Affected configurations (NVD CPE)

cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* ≤ 1.27.8

Affected products

Product	Versions
py-pdf · pypdf	affected < 1.27.9

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD