Apache Pdfbox vulnerabilities
9 known vulnerabilities affecting apache/pdfbox.
Total CVEs
9
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1MEDIUM7
Vulnerabilities
Page 1 of 1
CVE-2026-23907MEDIUMCVSS 5.3≥ 2.0.24, ≤ 2.0.35≥ 3.0.0, ≤ 3.0.72026-03-10
CVE-2026-23907 [MEDIUM] CWE-22 CVE-2026-23907: This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, f
This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because
the filename that is obtained from
PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied t
nvd
CVE-2021-31812MEDIUMCVSS 5.5≥ 2.0.0, ≤ 2.0.232021-06-12
CVE-2021-31812 [MEDIUM] CWE-834 CVE-2021-31812: In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file.
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
nvd
CVE-2021-31811MEDIUMCVSS 5.5≥ 2.0.0, ≤ 2.0.232021-06-12
CVE-2021-31811 [MEDIUM] CWE-789 CVE-2021-31811: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading th
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
nvd
CVE-2021-27807MEDIUMCVSS 5.5≥ 2.0.0, ≤ 2.0.222021-03-19
CVE-2021-27807 [MEDIUM] CWE-834 CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
nvd
CVE-2021-27906MEDIUMCVSS 5.5≥ 2.0.0, ≤ 2.0.222021-03-19
CVE-2021-27906 [MEDIUM] CWE-789 CVE-2021-27906: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
nvd
CVE-2019-0228CRITICALCVSS 9.8v2.0.142019-04-17
CVE-2019-0228 [CRITICAL] CWE-611 CVE-2019-0228: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent att
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
nvd
CVE-2018-11797MEDIUMCVSS 5.5≥ 1.8.0, ≤ 1.8.15≥ 2.0.1, ≤ 2.0.11+2 more2018-10-05
CVE-2018-11797 [MEDIUM] CVE-2018-11797: In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
nvd
CVE-2018-8036MEDIUMCVSS 6.5≤ 1.8.14≥ 2.0.0, ≤ 2.0.10+1 more2018-07-03
CVE-2018-8036 [MEDIUM] CWE-835 CVE-2018-8036: In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can tr
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
nvd
CVE-2016-2175HIGHCVSS 7.8v1.8.0v1.8.1+11 more2016-06-01
CVE-2016-2175 [HIGH] CVE-2016-2175: Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
nvd