CVE-2023-36810

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-407

• https://github.com/py-pdf/pypdf/issues/582Exploit, Issue Tracking, Vendor Advisory
• https://github.com/py-pdf/pypdf/pull/808Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqwExploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
• https://github.com/py-pdf/pypdf/issues/582Exploit, Issue Tracking, Vendor Advisory
• https://github.com/py-pdf/pypdf/pull/808Patch
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqwExploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html

Published

Jun 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36805Windows MSHTML Platform Security Feature Bypass Vulnerabilit…7
• CVE-2023-36806Contao is an open source content management system. Starting…5.4
• CVE-2023-36807pypdf is a pure-python PDF library capable of splitting, mer…6.5
• CVE-2023-36808GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-36809Kiwi TCMS, an open source test management system allows user…5.4
• CVE-2023-3681A vulnerability classified as problematic was found in Campc…6.1
• CVE-2023-36811borgbackup is an opensource, deduplicating archiver with com…4.7
• CVE-2023-36812OpenTSDB is a open source, distributed, scalable Time Series…9.8
• CVE-2023-36813Kanboard is project management software that focuses on the …8.8
• CVE-2023-36814Products.CMFCore are the key framework services for the Zope…7.5
• CVE-2023-36815Sealos is a Cloud Operating System designed for managing clo…8.1
• CVE-2023-368162FA is a Web app to manage Two-Factor Authentication (2FA) a…6.1