Skip to content
OpenAdvisories
Medium USN-6280-1 1 CVE

pypdf2 vulnerability

Published Aug 10, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PyPDF2 incorrectly handled PDF files with certain
markers. If a user or automated system were tricked into processing a
specially crafted file, an attacker could possibly use this issue to
consume system resources, resulting in a denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS pypdf2 1.26.0-3ubuntu1.20.04.2
Ubuntu · 22.04 LTS 22.04:LTS pypdf2 1.26.0-4ubuntu0.22.04.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS pypdf2 1.25.1-1ubuntu0.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS pypdf2 1.26.0-2ubuntu0.1~esm2

Vulnerabilities 1

  • Medium 6.2
    CVE-2023-36810

    Quadratic runtime with malformed PDF missing xref marker in pypdf

    pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current proc…

    py-pdf pypdf pypdf2 pypdf2 Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-36810