Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

pdfbox

Source -

NVD

CNA CVEs -

0

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

9
Related CVEsRelated VendorsRelated AssignersReports
9Vulnerabilities found
CVE-2026-23907
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.3||MEDIUM
EPSS-0.06% / 18.40%
||
7 Day CHG~0.00%
Published-10 Mar, 2026 | 09:43
Updated-13 Mar, 2026 | 16:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

Action-Not Available
Vendor-The Apache Software Foundation
Product-pdfboxApache PDFBox Examples
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-31812
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.5||MEDIUM
EPSS-0.21% / 43.39%
||
7 Day CHG~0.00%
Published-12 Jun, 2021 | 09:45
Updated-03 Aug, 2024 | 23:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
A carefully crafted PDF file can trigger an infinite loop while loading the file

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

Action-Not Available
Vendor-The Apache Software FoundationFedora ProjectOracle Corporation
Product-banking_supply_chain_financepdfboxcommunications_messaging_serverfedorabanking_corporate_lending_process_managementbanking_credit_facilities_process_managementretail_customer_management_and_segmentation_foundationApache PDFBox
CWE ID-CWE-834
Excessive Iteration
CWE ID-CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2021-31811
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.5||MEDIUM
EPSS-0.33% / 55.65%
||
7 Day CHG~0.00%
Published-12 Jun, 2021 | 09:45
Updated-03 Aug, 2024 | 23:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

Action-Not Available
Vendor-The Apache Software FoundationFedora ProjectOracle Corporation
Product-banking_supply_chain_financeprimavera_unifierpdfboxflexcube_universal_bankingcommunications_messaging_serverfedoraoutside_in_technologybanking_corporate_lending_process_managementbanking_credit_facilities_process_managementbanking_treasury_managementretail_customer_management_and_segmentation_foundationbanking_trade_financeApache PDFBox
CWE ID-CWE-789
Memory Allocation with Excessive Size Value
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2021-27906
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.5||MEDIUM
EPSS-0.65% / 70.82%
||
7 Day CHG~0.00%
Published-19 Mar, 2021 | 16:05
Updated-13 Feb, 2025 | 16:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Action-Not Available
Vendor-Fedora ProjectOracle CorporationThe Apache Software Foundation
Product-peoplesoft_enterprise_peopletoolsprimavera_unifierpdfboxcommunications_messaging_serveroutside_in_technologycommunications_session_report_managerbanking_trade_finance_process_managementbanking_supply_chain_financeflexcube_universal_bankinghyperion_financial_reportingfedoraretail_xstore_point_of_servicebanking_corporate_lending_process_managementwebcenter_siteshyperion_infrastructure_technologybanking_credit_facilities_process_managementbanking_virtual_account_managementbanking_treasury_managementretail_customer_management_and_segmentation_foundationApache PDFBox
CWE ID-CWE-789
Memory Allocation with Excessive Size Value
CVE-2021-27807
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.5||MEDIUM
EPSS-0.49% / 65.68%
||
7 Day CHG~0.00%
Published-19 Mar, 2021 | 16:05
Updated-13 Feb, 2025 | 16:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
A carefully crafted PDF file can trigger an infinite loop while loading the file

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Action-Not Available
Vendor-Fedora ProjectOracle CorporationThe Apache Software Foundation
Product-banking_trade_finance_process_managementprimavera_unifierpdfboxflexcube_universal_bankinghyperion_financial_reportingcommunications_messaging_serverfedoraretail_xstore_point_of_serviceoutside_in_technologycommunications_session_report_managerhyperion_infrastructure_technologywebcenter_sitesbanking_virtual_account_managementbanking_treasury_managementretail_customer_management_and_segmentation_foundationApache PDFBox
CWE ID-CWE-834
Excessive Iteration
CVE-2019-0228
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-9.8||CRITICAL
EPSS-13.03% / 94.11%
||
7 Day CHG~0.00%
Published-17 Apr, 2019 | 14:07
Updated-04 Aug, 2024 | 17:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Action-Not Available
Vendor-n/aThe Apache Software FoundationFedora ProjectOracle Corporation
Product-banking_trade_finance_process_managementpeoplesoft_enterprise_peopletoolsbanking_supply_chain_financepdfboxcommunications_messaging_serverhyperion_financial_reportingfedoraretail_xstore_point_of_servicejamesbanking_corporate_lending_process_managementcommunications_session_report_managerwebcenter_sitesbanking_credit_facilities_process_managementbanking_virtual_account_managementApache PDFBox
CWE ID-CWE-611
Improper Restriction of XML External Entity Reference
CVE-2018-11797
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-5.5||MEDIUM
EPSS-1.62% / 81.86%
||
7 Day CHG~0.00%
Published-05 Oct, 2018 | 20:00
Updated-16 Sep, 2024 | 16:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Action-Not Available
Vendor-The Apache Software FoundationFedora ProjectOracle Corporation
Product-fedoraretail_xstore_point_of_servicepdfboxApache PDFBox
CVE-2018-8036
Assigner-Apache Software Foundation
ShareView Details
Assigner-Apache Software Foundation
CVSS Score-6.5||MEDIUM
EPSS-0.55% / 67.91%
||
7 Day CHG~0.00%
Published-03 Jul, 2018 | 20:00
Updated-16 Sep, 2024 | 18:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Action-Not Available
Vendor-The Apache Software Foundation
Product-pdfboxApache PDFBox
CWE ID-CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2016-2175
Assigner-Red Hat, Inc.
ShareView Details
Assigner-Red Hat, Inc.
CVSS Score-7.8||HIGH
EPSS-3.38% / 87.40%
||
7 Day CHG~0.00%
Published-01 Jun, 2016 | 20:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Action-Not Available
Vendor-n/aThe Apache Software FoundationDebian GNU/Linux
Product-debian_linuxpdfboxn/a