CVE Feed

    Dashboard / CVE / CVE-2023-36810

    CVE-2023-36810

    pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published:Jun 30, 2023
    Last Modified:Feb 13, 2025
    EPS:Jun 30, 2023
    EPSS Score:0.00123
    CVSS Score:6.2

    Affected Products

    Vendor
    Pypdf Project
    Product
    Pypdf

    Exploits

    https://github.com/py-pdf/pypdf/issues/582https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqwhttps://github.com/py-pdf/pypdf/issues/582https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-48155 (CVSS 4.8) — pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerabil…
    CVE-2026-48156 (CVSS 5.1) — pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerabil…
    CVE-2026-48735 (CVSS 6.9) — pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerabil…
    CVE-2026-41314 (CVSS 4.8) — pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versi…
    CVE-2026-41313 (CVSS 4.8) — pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versi…
    CVE-2026-41312 (CVSS 4.8) — pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versi…
    CVE-2026-41168 (CVSS 6.9) — pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versi…
    CVE-2026-40260 (CVSS 6.9) — pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata…
    CVE-2026-33699 (CVSS 4.6) — pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which…
    CVE-2026-33123 (CVSS 5.1) — pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High