CVE-2023-36807

MediumCVSS 6.5/10Last modified Nov 2, 2026

Description

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
py-pdf	pypdf	2.10.5
pypdf_project	pypdf	2.10.5

References

https://github.com/py-pdf/pypdf/issues/1329Exploit, Issue Tracking, Vendor Advisory
https://github.com/py-pdf/pypdf/pull/1331Patch
https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55mExploit, Mitigation, Patch, Vendor Advisory
https://github.com/py-pdf/pypdf/issues/1329Exploit, Issue Tracking, Vendor Advisory
https://github.com/py-pdf/pypdf/pull/1331Patch
https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55mExploit, Mitigation, Patch, Vendor Advisory

Timeline

Published: Jun 30, 2023
Last modified: Nov 2, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-368089.8GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form CVE-2023-368095.4Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS pr CVE-2023-36816.1A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code o CVE-2023-368106.5pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses th CVE-2023-368114.7borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authenticatio CVE-2023-368129.8OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability CVE-2023-368138.8Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to per CVE-2023-368147.5Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handl CVE-2023-368158.1Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw i CVE-2023-368166.12FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection CVE-2023-368179.1`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public c CVE-2023-368187.5Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denia