---
id: CVE-2023-36810
aliases:
  - GHSA-jrm6-h9cq-8gqw
  - PYSEC-2026-1837
title: PyPDF2 quadratic runtime with malformed PDF missing xref marker
summary: PyPDF2 quadratic runtime with malformed PDF missing xref marker
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: pypdf2
product: pypdf2
ecosystem: pip
affected:
  - pypdf2 < 1.27.9
patched:
  - pypdf2 1.27.9
published: '2023-06-30'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jrm6-h9cq-8gqw'
references:
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-36810'
  - url: 'https://github.com/py-pdf/pypdf/issues/582'
  - url: 'https://github.com/py-pdf/pypdf/pull/808'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373
  - url: 'https://github.com/py-pdf/pypdf'
  - url: 'https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html'
tags:
  - osv
  - pip
epss: 0.0063
epssPercentile: 0.47936
ingestedAt: '2026-07-08T18:25:50.882Z'
---

## Overview

### Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.
This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

### Patches
https://github.com/py-pdf/pypdf/pull/808

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)
* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)

## Affected packages

- `pypdf2 < 1.27.9`

## Remediation

Upgrade to a patched release:

- `pypdf2 1.27.9`