CVE-2023-36810 - CVE House
Back to Database
Status published Medium CVE-2023-36810

Quadratic runtime with malformed PDF missing xref marker in pypdf

Vulnerability Description

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-36810

Credits & Attribution

No credits recorded in the NVD database.

References

More from py-pdf

View All →
CVE-2025-66019
pypdf manipulated LZWDecode streams can exhaust RAM
Medium 6.6
CVE-2025-62708
pypdf manipulated LZWDecode streams can exhaust RAM
Medium 6.6
CVE-2025-62707
pypdf affected by possible infinite loop when reading DCT inline images without EOF marker
Medium 6.6
CVE-2025-55197
pypdf's Manipulated FlateDecode streams can exhaust RAM
Medium 6.6
CVE-2023-46250
pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
Medium 5.1

Affected Vendor

Affected Software

pypdf
Vulnerable Versions:
< 1.27.9

Timeline

Official Publish: June 30th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-407

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.