CVE-2023-36810

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-368114.7borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authenticatio CVE-2023-368129.8OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability CVE-2023-368138.8Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to per CVE-2023-368147.5Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handl CVE-2023-368158.1Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw i CVE-2023-368166.12FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection CVE-2023-368179.1`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public c CVE-2023-368187.5Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denia CVE-2023-368196.5Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/k CVE-2023-36829.8A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of CVE-2023-368206.5Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6,CVE-2023-368218.8Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.