CVE-2023-36810: Quadratic runtime with malformed PDF missing xref marker in pypdf

Published Jun 30, 2023
·
Updated

Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

Patches https://github.com/py-pdf/pypdf/pull/808

Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?

References PyPDF2 PR #808 PyPDF2 Issue #582

Other sources

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Software

7 affected componentsFixes available
ubuntu/pypdf2<1.26.0-2ubuntu0.1~
1.26.0-2ubuntu0.1~
ubuntu/pypdf2<1.26.0-3ubuntu1.20.04.2
1.26.0-3ubuntu1.20.04.2
ubuntu/pypdf2<1.26.0-4ubuntu0.22.04.2
1.26.0-4ubuntu0.22.04.2
ubuntu/pypdf2<1.25.1-1ubuntu0.1~
1.25.1-1ubuntu0.1~
debian/pypdf2<=1.26.0-2, <=1.26.0-4
1.26.0-2+deb10u22.12.1-3
pip/PyPDF2<=1.27.8
1.27.9
Pypdf Project Pypdf<=1.27.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/pypdf2 to a version that resolves this vulnerability.

    Fixed in 1.26.0-2ubuntu0.1~
  2. Upgrade

    Upgrade ubuntu/pypdf2 to a version that resolves this vulnerability.

    Fixed in 1.26.0-3ubuntu1.20.04.2
  3. Upgrade

    Upgrade ubuntu/pypdf2 to a version that resolves this vulnerability.

    Fixed in 1.26.0-4ubuntu0.22.04.2
  4. Upgrade

    Upgrade ubuntu/pypdf2 to a version that resolves this vulnerability.

    Fixed in 1.25.1-1ubuntu0.1~
  5. Upgrade

    Upgrade debian/pypdf2 to a version that resolves this vulnerability.

    Fixed in 1.26.0-2+deb10u2Fixed in 2.12.1-3
  6. Upgrade

    Upgrade pip/PyPDF2 to a version that resolves this vulnerability.

    Fixed in 1.27.9
  7. Upgrade

    Upgrade PyPDF2 (pypdf) to a version that resolves this vulnerability.

    Fixed in 1.27.9
  8. Upgrade

    Upgrade PyPDF2 (pypdf) to a version that resolves this vulnerability.

    Patch PR #808

Event History

Jun 30, 2023
CVE Published
12:00 AM
CVE Published
via MITRE·06:43 PM
Data Sourced
via MITRE·06:43 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
10:17 PM
Oct 9, 2023
Data Sourced
03:15 AM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the impact of CVE-2023-36810?

An attacker can craft a PDF that leads to unexpected long runtime and utilizes 100% of a single CPU core.

2

How does CVE-2023-36810 affect the system's performance?

It blocks the current process and can cause high CPU usage.

3

What software is affected by CVE-2023-36810?

PyPDF2 versions up to and including 1.27.8, pypdf2 versions up to and including 1.26.0-2ubuntu0.1~, 1.26.0-3ubuntu1.20.04.2, 1.26.0-4ubuntu0.22.04.2, 1.25.1-1ubuntu0.1~, and pypdf versions up to and including 1.27.8.

4

How can I fix CVE-2023-36810?

Apply the corresponding patches or updates for the affected software versions, which can be found in the provided references.

5

What is the Common Weakness Enumeration (CWE) ID for CVE-2023-36810?

The CWE ID for CVE-2023-36810 is CWE-407 (Uncontrolled Resource Consumption).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203