CVE-2023-36810CWE-407

Quadratic runtime with malformed PDF missing xref marker in pypdf

Medium · published June 30, 2023

CVSS v3.1
6.2
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.6th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2023-06-30T18:43Z
EPSS history
Timeline
  • 30 JUN 18:43Z
    Quadratic runtime with malformed PDF missing xref marker in pypdf
    cvelistv5