CVE-2023-36810: pypdf project pypdf

csirt@kutim:~/threat-intel/cve/CVE-2023-36810

CVSS 6.5 · Medium EPSS 0,63%

Kerentanan Inefficient Algorithmic Complexity pada pypdf project pypdf. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 30 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-407: Inefficient Algorithmic Complexity
EPSS (30 hari): 0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pypdf project	pypdf	Semua versi hingga 1.27.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/py-pdf/pypdf/issues/582 exploit · issue tracking · advisory vendor
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw exploit · patch · advisory vendor
https://github.com/py-pdf/pypdf/pull/808 patch
https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.