CVE-2023-36810
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker can craft a PDF that leads to unexpected long runtime, blocking the current process and utilizing 100% of a single CPU core.
Risk Assessment
This vulnerability can lead to significant resource strain, potentially impacting application performance and service availability within the organization.
Recommendation
It is recommended to upgrade to version 1.27.9 or later to patch this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.