id: PYSEC-2026-1837
published: "2026-07-07T11:45:19.715500Z"
modified: "2026-07-07T17:25:13.325659Z"
aliases:
- CVE-2023-36810
- GHSA-jrm6-h9cq-8gqw
summary: PyPDF2 quadratic runtime with malformed PDF missing xref marker
details: "### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.\nThis quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.\n\n### Patches\nhttps://github.com/py-pdf/pypdf/pull/808\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)\n* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)"
affected:
- package:
    name: pypdf2
    ecosystem: PyPI
    purl: pkg:pypi/pypdf2
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.27.9
  versions:
  - "1.15"
  - "1.16"
  - "1.17"
  - "1.18"
  - "1.19"
  - "1.20"
  - "1.21"
  - "1.22"
  - "1.23"
  - "1.24"
  - "1.25"
  - 1.25.1
  - 1.26.0
  - 1.27.0
  - 1.27.1
  - 1.27.2
  - 1.27.3
  - 1.27.4
  - 1.27.5
  - 1.27.6
  - 1.27.7
  - 1.27.8
references:
- type: WEB
  url: https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-36810
- type: WEB
  url: https://github.com/py-pdf/pypdf/issues/582
- type: WEB
  url: https://github.com/py-pdf/pypdf/pull/808
- type: FIX
  url: https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373
- type: PACKAGE
  url: https://github.com/py-pdf/pypdf
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
- type: PACKAGE
  url: https://pypi.org/project/pypdf2
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jrm6-h9cq-8gqw
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H