PyPI/pypdf2 CVE-2023-36810: medium 6.2, EPSS 0.63%

PyPDF2 quadratic runtime with malformed PDF missing xref marker

Action: Upgrade pypdf2 to 1.27.9 or later.

pip install pypdf2==1.27.9

Affected

Fixed versions

Sources

• osv: GHSA-jrm6-h9cq-8gqw
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
• https://nvd.nist.gov/vuln/detail/CVE-2023-36810
• https://github.com/py-pdf/pypdf/issues/582
• https://github.com/py-pdf/pypdf/pull/808
• https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373
• https://github.com/py-pdf/pypdf
• https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html

CVE-2023-36810 · published 2023-06-30T22:17:52Z · modified 2026-07-07T17:57:15.295956748Z · JSON