Medium severity · published Jun 30, 2023
CVE-2023-36810
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
Pypdf · Pypdf Project
through 1.27.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36810
Exploit
https://github.com/py-pdf/pypdf/issues/582
Patch
https://github.com/py-pdf/pypdf/pull/808
Exploit
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
More from Pypdf
7.5
CVE-2026-103000
pypdf: Possible large memory usage when retrieving alphabetical page labels
7.5
CVE-2026-102999
pypdf: Possible long runtimes with large amount of embedded files
7.5
CVE-2026-102998
pypdf: Possible long runtimes when generating appearance streams
7.5
CVE-2026-102997
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
7.5
CVE-2026-102996
pypdf: Possible large memory usage when parsing font data