Allocation of Resources Without Limits or Throttling in iText

2022-02-0200:01:45

Google

osv.dev

0.002 Low

EPSS

Percentile

54.0%

JSON

iText v7.1.17 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

CPENameOperatorVersion
com.itextpdf:itext7-coreeq7.1.12
com.itextpdf:itext7-coreeq7.1.15
com.itextpdf:itext7-coreeq7.1.16
com.itextpdf:itext7-coreeq7.0.8
com.itextpdf:itext7-coreeq7.1.1
com.itextpdf:itext7-coreeq7.1.8
com.itextpdf:itext7-coreeq7.0.6
com.itextpdf:itext7-coreeq7.1.11
com.itextpdf:itext7-coreeq7.1.5
com.itextpdf:itext7-coreeq7.1.6

Name	Operator	Version
com.itextpdf:itext7-core	eq	7.1.12
com.itextpdf:itext7-core	eq	7.1.15
com.itextpdf:itext7-core	eq	7.1.16
com.itextpdf:itext7-core	eq	7.0.8
com.itextpdf:itext7-core	eq	7.1.1
com.itextpdf:itext7-core	eq	7.1.8
com.itextpdf:itext7-core	eq	7.0.6
com.itextpdf:itext7-core	eq	7.1.11
com.itextpdf:itext7-core	eq	7.1.5
com.itextpdf:itext7-core	eq	7.1.6